sql注入 tow day

基本语句查询

>select * from users where id=1;
#select+列名（*代表所有）from+表名 where+条件语句

>select * from users where id in ('3');
#从users表格，查询所有包含id为3

>select * from users where id=(select id from users where username=('admin'));
#子查询 优先执行()内查询语句

union

>select id from users union select email_id from emails;
#查询并合并数据显示

>select * from users where id=6 union select * from emails where id=6;
ERROR：have a different number of columns 联合注入前后表格列数必须相等

>select * from users where id=6 union select * ，3 from emails where id=6;
#3为填充列

group by 分组

>select department,count(id) from student group by department;
#查询department 院系人数 count (id) 对ID进行计数

一般用于二分法判断数据表列数
>select * from users were id=9 group by 2;
#by2,4,8~~~依次排查到报错为止，从而确定列数；
>select * from users where id=9 group by 4;

… …

order by 默认按照升序排列

>select stu_id from score shere c_name='计算机' order by grade desc;
#grade参数desc使排列顺序变为降序
同group by，一般用于判断数据表列数

limit 限制输出内容数量

>select * from users limit 1,3;
#限制为从第1行开始显示3行

>select * from users limit 0,3;
#限制为从第0行开始显示3行
(实际是从0行开始计数)

and 和 or

>select *from student where sex='男' and department='英语系';
#显示同时满足的内容

>select *from student where sex='男' or department='英语系';
#显示任意一条满足的内容

常用函数

group_concat  合并到一行显示
>select username from users;

>select group_concat(username) from users;

select database() 查看当前数据库名称
select version() 查卡当前数据库版本