You can see the classification of SQL injection. SQL injection point /sql injection type /sql injection has several /sql injection point classifications

「 Author URI 」： Three days wyx
「 Author's brief introduction 」：CSDN top200、 Alibaba cloud blog expert 、 Huawei cloud sharing expert 、 High quality creators in the field of network security

According to the input 「 Parameters 」 type , Can be SQL Injections fall into two broad categories ： 「 Numerical type 」 Inject 、 「 Character 」 Inject

One 、 Numerical injection

The parameters entered in the foreground page are 「 Numbers 」.

For example, the following is based on ID Query the user's function .

Background corresponding SQL as follows , The field type is numeric , This is numerical injection .

select * from user where id = 1;

Two 、 Character injection

The parameters entered in the foreground page are 「 character string 」.

For example, the following login function , The user name and password entered are strings .

Background corresponding SQL as follows , Field type is character type , This is character injection .

select * from user 
where username = 'zhangsan' and password = '123abc';

Characters can be wrapped in single quotes , You can also use double quotation marks to wrap , According to the package string 「 quotes 」 Different , Character injection can be divided into ：「 Single quote character 」 Injection and 「 Double quotation mark character type 」 Inject .

1） Single quote character Injection

Parameters use 「 Single quotation marks 」 When wrapping , It is called single quote character injection , Like this one down here SQL, Single quotation mark character injection .

select * from user where username = 'zhangsan';

2） Double quote character Injection

Parameters use 「 Double quotes 」 When wrapping , It is called double quotation mark character injection , Like this one down here SQL, Double quotation mark character injection .

select * from user where username = "zhangsan";

3） Parenthesized injection

In theory , There are only two injection types: numeric and character .

SQL The grammar of , Support the use of one or more 「 Brackets 」 Package parameters , There are some variations of these two basic injection types .

a. Numerical type + Injection of parentheses

Wrap numeric parameters in parentheses , Like the following SQL.

select * from user where id = (1);
select * from user where id = ((1));
 Wrap multiple parentheses ……

b. Single quote string + Injection of parentheses

Use parentheses and single quotation marks to wrap the parameters , Like the following SQL.

select * from user where username = ('zhangsan');
select * from user where username = (('zhangsan'));
 Wrap multiple parentheses ……

c. Double quote string + Injection of parentheses

Wrap the arguments in parentheses and double quotes , Like the following SQL

select * from user where username = ("zhangsan");
select * from user where username = (("zhangsan"));
 Wrap multiple parentheses ……

3、 ... and 、 Other types

In addition to the classification according to parameters , There are other classifications .

According to the data 「 submission 」 classification ：

1. GET Inject ： Use get Request to submit data , such as xxx.php?id=1.
2. POST Inject ： Use post Request to submit data , Like forms .
3. Cookie Inject ： Use Cookie Submit data in a field of , For example Cookie Save user information in .
4. HTTP Header Inject ： Submit data using request headers , For example, testing HTTP Source address in 、 host IP etc. .

According to the page 「 Echo 」 classification ：

1. Explicit note ： The front page can echo user information , such as Joint injection 、 An error injection .
2. Blind note ： The front page cannot echo user information , such as Bull's blind note 、 Time blind note .

Thank you for your praise 、 Collection 、 Comment on , I'm three days 、 I wish you happiness .