For SQL injection and defense, having 1 = 1, sqlhaving

For SQL injection and defense, having 1 = 1, sqlhaving

The latest version of SQL injection and defense is shown on the 32nd page. Note: It is used to display information about statements executed by the database, such as having 1 = 1.

My database: mysql

Version: 5.1.66

Run: select * from aa where id = 2 having 1 = 1; -- convert the injection into the actual SQL statement.

Result: The result is correct.

Certificate --------------------------------------------------------------------------------------------------------------------------------------------------

Database: SQL server

When running the preceding SQL statement, the error message is "group by IS MISSING ". It can be seen that at least in the current mysql database, the execution information of the database cannot be obtained through this method.

 

Certificate ---------------------------------------------------------------------------------------------------------------------------------------------------

This involves: Which functions in mysql must exist at the same time. At least the SQL statements that are constructed are not plenary, leading to server errors.