当前位置:网站首页>SQL injection -day15
SQL injection -day15
2022-07-07 03:43:00 【kanna_ bush_ t】
3、 ... and 、Mysql Inject
3.1 necessary
3.1.1 Meta database information_schema
a. information_schema In the database tables What's in the table :
b. infomation_schema database columns What's in the table :
3.1.2 Sentence classification
- DQL( Data query language ): Query statement , be-all select sentence
- DML( Data operation language ):insert , delete , update , On the table data Conduct Additions and deletions
- DDL( Data definition language ):create , drop , alter Counter table structure Of Additions and deletions
- TCL( Transaction control language ):commit Submit data ,rollback Undo Data Transaction
- DCL( Data control language ):grant to grant authorization ,revoke Revocation of authority, etc
3.1.3 Basic statement
Check the library :
- show databases;
- select schema_name from information_schema.schemata;
- create database + Library name ;
- drop database + Library name ;
- use + Library name ;
- show tables;
- select table_name from information_schema.tables where table_schema='securit
- select table_name from information_schema.tables where table_schema=database Basic functions
- select * from users;
- select column_name from information_schema.columns where table_name='users'
- select username,password from security.users;
3.1.4 Basic functions
Database installation 、 route , user Information | |
version() | Mysql Database version |
database() | Current database name |
user() | The user name of the database |
current_user() | Current user name |
session_user() | The user name of the database connected to |
system_user() | System user name |
@@datadir() | Storage path of database file |
@@version_compile_os | Operating system version |
@@basedir | Database installation directory |
String length 、 Intercept | |
length() | Returns the length of the string |
substring(a,b,c) | Intercepting string |
substr(a,b,c) | Intercepting string |
mid(a,b,c) | Intercepting string |
Three parameters :a. Intercepted string b. Intercept start position c. length | |
left(a,b) | Take... From the left a Before b position , Correct return 1, Erroneous return 0 |
Special handling of strings | |
ord() | return ASCII code |
ascii('a') | Alphabet a Convert to ASCII value |
rand() | return 0~1 Between random floating-point numbers |
round() | Returns the latest integer value |
md5() | return MD5 value |
hex() | Converts a string to hexadecimal |
unhex() | hex() Reverse operation of |
floor(x) | Return is no greater than x Maximum integer for |
load_file() | Read the file , Returns the contents of the file as a string |
sleep(a) | A dead sleep a second |
if(true,t,f) | The judgment sentence is true , Execute the first , Otherwise, the second |
find_in_set() | Returns the position of the string in the string list |
benchmark() | Specifies the number of times the statement is executed |
name_const() | Return table as result |
3.1.5 Import data
When you want to import a more Or you want to execute in batches sql When the sentence is , have access to mysql Medium source
边栏推荐
- 大白话高并发(二)
- 22.(arcgis api for js篇)arcgis api for js圆采集(SketchViewModel)
- Can the applet run in its own app and realize live broadcast and connection?
- Kalman filter-1
- Shangsilicon Valley JVM Chapter 1 class loading subsystem
- [security attack and Defense] how much do you know about serialization and deserialization?
- Jerry's RTC clock development [chapter]
- [leetcode] 700 and 701 (search and insert of binary search tree)
- sshd[12282]: fatal: matching cipher is not supported: aes256- [email protected] [preauth]
- Enumeration general interface & enumeration usage specification
猜你喜欢
装饰设计企业网站管理系统源码(含手机版源码)
[dpdk] dpdk sample source code analysis III: dpdk-l3fwd_ 001
22. (ArcGIS API for JS) ArcGIS API for JS Circle Collection (sketchviewmodel)
CVPR 2022 best paper candidate | pip: six inertial sensors realize whole body dynamic capture and force estimation
【DPDK】dpdk样例源码解析之三:dpdk-l3fwd_001
ubuntu20安装redisjson记录
About Tolerance Intervals
Construction of Hisilicon universal platform: color space conversion YUV2RGB
QT 打开文件 使用 QFileDialog 获取文件名称、内容等
Set static IP for raspberry pie
随机推荐
接口数据安全保证的10种方式
It's too convenient. You can complete the code release and approval by nailing it!
Hisilicon 3559 universal platform construction: RTSP real-time playback support
Kalman filter-1
. Net interface can be implemented by default
Probability formula
Optimization cases of complex factor calculation: deep imbalance, buying and selling pressure index, volatility calculation
R data analysis: how to predict Cox model and reproduce high score articles
复杂因子计算优化案例:深度不平衡、买卖压力指标、波动率计算
API data interface of A-share index component data
About Confidence Intervals
23. (ArcGIS API for JS) ArcGIS API for JS ellipse collection (sketchviewmodel)
Can the applet run in its own app and realize live broadcast and connection?
MySQL storage engine
Depth analysis of compilation constants, classloader classes, and system class loaders
Decoration design enterprise website management system source code (including mobile source code)
Mobile measurement and depth link platform - Branch
Leetcode-02 (linked list question)
PHP lightweight Movie Video Search Player source code
Docker部署Mysql8的实现步骤