Thoughts on Mysql injection judgment

Sometimes it is difficult for us to use and 1 = 1 and 1 = 2 to determine whether injection exists .. In particular, such as wide byte injection .. For example, search injection .. When there is a wide byte injection, we add % d5 .. The database cannot be found.
 
 
This is where we can use latency injection to determine (of course, The or statement should also be OK, just a bit of thought)
 
For example:
 
Word = % d5 % 27 and 1 = 1% 23
 
Word = % d5 % 27 and 1 = 2% 23
 
It is unable to determine whether injection exists, because no query is found, then we can construct:
 
Word = % d5 % 27 and id = benchmark (1800000, md5 (144111) % 23
 
Because the id field usually exists, it takes some time to calculate 144111 as the md5 value for 1800000 times, resulting in a delay. If the browser is suspended, the injection vulnerability exists.
 
The above is just a bit of thought .. Do not shoot bricks.

Www.2cto.com: the author's copyright information is not found. If the author sees it, add it in the comment. We will add it in time. Please understand