当前位置:网站首页>In SQL injection, why must the ID of union joint query be equal to 0
In SQL injection, why must the ID of union joint query be equal to 0
2022-07-02 09:41:00 【hangshao0.0】
In fact, it is not necessary to let id=0
?id=0' union select 1,2,3 --+ ?id=0' union select 1,database(),3 --+
?id=0' union select 1,database(),user() --+

there id Special attention is needed :
If there are only two echo positions
that id You must fill in a nonexistent number (-1 perhaps 0), Joint query can echo successfully
Because in the data table ,id by 1,2,3,……
If the parameter is :?id=1' union select 1,2,3 --+
So the query statement is :select * from users where id='1' union select 1,2,3 --+' limit 0,1
id=1 The data is queried , Return to page , It occupies two echo positions 
This is the time , union The content of the query , Because the only two echo bits are occupied , It makes it impossible to echo
If id=2, The returned content will also occupy the echo bit , Lead to union The content of the query cannot be echoed to the page 
If id Is a number that does not exist in the table , for example id=0,id=-1 wait
So the query statement is :select * from users where id='0' union select 1,2,3 --+' limit 0,1
because id=0 No query results , So the page returns union The content of the query 
You don't have to let id=0
Actually id=-1,id=-5 It's OK to wait

therefore , We can know :
as long as union The previous query failed , that union The following query results can be echoed to the page
id=1’ and 1=2 union select 1,2,3 –+ adopt and 1=2 Statement to trigger an error
id=1’ or 1=1 union select 1,2,3 –+ adopt or 1=1 Statement to trigger an error

边栏推荐
- MySQL事务
- Chrome browser plug-in fatkun installation and introduction
- C语言之到底是不是太胖了
- Int to string, int to qstring
- Alibaba /热门json解析开源项目 fastjson2
- Difference between redis serialization genericjackson2jsonredisserializer and jackson2jsonredisserializer
- MySQL error: unblock with mysqladmin flush hosts
- BugkuCTF-web16(备份是个好习惯)
- VIM operation command Encyclopedia
- Chrome视频下载插件–Video Downloader for Chrome
猜你喜欢

Bold prediction: it will become the core player of 5g

Knowledge points are very detailed (code is annotated) number structure (C language) -- Chapter 3, stack and queue

Operation and application of stack and queue

PI control of three-phase grid connected inverter - off grid mode

Tools used for Yolo object recognition and data generation

自定義Redis連接池

JDBC回顾

ZK configuration center -- configuration and use of config Toolkit

Microservice practice | Eureka registration center and cluster construction

Image recognition - data augmentation
随机推荐
Image recognition - Data Acquisition
PI control of three-phase grid connected inverter - off grid mode
CKEditor 4.10.1 上传图片提示“不正确的服务器响应” 问题解决
Chrome user script manager tempermonkey monkey
Tools used for Yolo object recognition and data generation
Typora installation package sharing
Read 30 minutes before going to bed every day_ day4_ Files
Read Day6 30 minutes before going to bed every day_ Day6_ Date_ Calendar_ LocalDate_ TimeStamp_ LocalTime
Insight into cloud native | microservices and microservice architecture
BugkuCTF-web24(解题思路及步骤)
Supplier selection and prequalification of Oracle project management system
Hystrix implements request consolidation
Bold prediction: it will become the core player of 5g
Navicat remote connection MySQL reports an error 1045 - access denied for user 'root' @ '222.173.220.236' (using password: yes)
记录下对游戏主机配置的个人理解与心得
每天睡觉前30分钟阅读_day3_Files
Bugkuctf-web21 (detailed problem solving ideas and steps)
Redis 序列化 GenericJackson2JsonRedisSerializer和Jackson2JsonRedisSerializer的区别
How to use pyqt5 to make a sensitive word detection tool
Say goodbye to 996. What are the necessary plug-ins in idea?