sql注入-报错注入

注入源代码

<?php
/**
author:txf
*/
header('content-type: text/html; charset=utf-8'); //设置utf-8编码防止乱码
$id = isset($_GET['id']) ? $_GET['id'] : 1; //id不赋值时默认为id=1
$conn = @mysql_connect('127.0.0.1','root','root');  //@符号屏蔽出错
mysql_select_db('sqltest',$conn); 
$sql = "select * from user where id=$id"; 
$result = mysql_query($sql);
while($row = mysql_fetch_array($result)){
    echo "用户ID：" . $row['id'] . "<br/>";
    echo "用户名：" . $row['user'] . "<br/>";
    echo "用户密码：" . $row['password'] . "<br/>";
}

mysql_close($conn);
echo "<hr>";
echo "您当前执行的sql语句为：" ;
echo $sql;

?>

1.单引号报错

报错

2.order by 判断列数

orderby
3.联合查询
unionselect

4.爆数据库

爆数据库
5.爆sqltest数据库的表
爆表
6.爆user表的列
爆列
7.爆对应列的字段
爆字段