一篇学会SQL注入 | 详解SQL注入（基础向，基础到每个参数）

mysql 基本用法

查库：select schema_name from information_schema.schemata;
查表：select table_name from information_schema.tables where table_schema='security';
查列：select column_name from information_schema.columns where table_name='users';
查字段：select username,password from security.users;

基本函数

left() 函数

left(a,b) 从左侧截取a的前b位，正确返回1，错误返回0

mysql> select left(database(),3)='s';   // 截取前三位，但是右边就只有一位
+------------------------+
| left(database(),3)='s' |
+------------------------+
|                      0 |     // 错误
+------------------------+
1 row in set (0.00 sec)

mysql> select left(database(),3)='sec';
+--------------------------+
| left(database(),3)='sec' |
+--------------------------+
|                        1 |
+--------------------------+
1 row in set (0.00 sec)

mysql> select left(database(),1)='s';
+------------------------+
| left(database(),1)='s' |
+------------------------+
|                      1 |
+------------------------+
1 row in set (0.00 sec)

regexp 函数

regexp 函数： select user() regexp 'r'     user()的结果是里有r，则为1，否则0


mysql> select user();
+----------------+
| user()         |
+----------------+
| root@localhost |
+----------------+
1 row in set (0.00 sec)

mysql> select user() regexp 'root';
+----------------------+
| user() regexp 'root' |
+----------------------+
|                    1 |
+----------------------+
1 row in set (0.00 sec)

mysql> select user() regexp 'r';
+-------------------+
| user() regexp 'r' |
+-------------------+
|                 1 |
+-------------------+
1 row in set (0.00 sec)

mysql> select user() regexp 'lo';
+--------------------+
| user() regexp 'lo' |
+--------------------+
|                  1 |
+--------------------+
1 row in set (0.00 sec)


mysql> select user() regexp 'roc';
+---------------------+
| user() regexp 'roc' |
+---------------------+
|                   0 |
+---------------------+
1 row in set (0.00 sec)





// 如果在语句中使用 ^ 那么就会在最开始查，而不加 ^ 就会在整个语句中查找是否匹配
mysql> select user() regexp 'lo';
+--------------------+
| user() regexp 'lo' |
+--------------------+
|                  1 |
+--------------------+
1 row in set (0.00 sec)

mysql> select user() regexp '^lo';
+---------------------+
| user() regexp '^lo' |
+---------------------+
|                   0 |
+---------------------+
1 row in set (0.00 sec)

like 函数

like 函数： select user() like 'ro%'       匹配和 regexp 相似 与 regexp 区别在于 like 只能在开头匹配， regexp 全文匹配



mysql> select user();
+----------------+
| user()         |
+----------------+
| root@localhost |
+----------------+
1 row in set (0.00 sec)

mysql> select user() like 'root%';
+---------------------+
| user() like 'root%' |
+---------------------+
|                   1 |
+---------------------+
1 row in set (0.00 sec)

mysql> select user() like 'loca%';
+---------------------+
| user() like 'loca%' |
+---------------------+
|                   0 |
+---------------------+
1 row in set (0.00 sec)

substr 函数

substr(a,b,c)  :    select substr() XXXX        substr(a,b,c)  a 字符串中，从 b 位置开始截取 c 个字符

ascii() 函数

//将某个字符串转化为 ascii 值

mysql> select ascii('a');
+------------+
| ascii('a') |
+------------+
|         97 |
+------------+
1 row in set (0.00 sec)


mysql> select ascii(substr((select database()),1,1));
+----------------------------------------+
| ascii(substr((select database()),1,1)) |
+----------------------------------------+
|                                    115 |
+----------------------------------------+
1 row in set (0.00 sec)


mysql> select ascii(substr((select database()),1,1))>1