MySQL injection bypass Technique (ii)

This time, the filter of the injected space lattice

① Comment Bypass Space

We need a space when we look at user ()

Such as:

Select User ();

　　

Then we use

/**/

To bypass

② Plus bypass spaces (not recommended for use except for individual cases)

In fact, the space can be replaced with a +

Such as:

Select+user ();

Although this allows you to query the data

But carefully found that the target of the query is +user ()

But the data returned is the same.

Not just the user () or anything else, such as

SELECT @ @basedir and [email protected] @basedir

　　

It is estimated that this can only be used in a single statement such as Select User (), select @ @basedir, select version (), Medium

③ using parentheses instead of spaces

For example

Select (User ())

Enclosed in parentheses is ....

MySQL injection bypass Technique (ii)