---
# System prepended metadata

title: SQL Bases
tags: [web, sql]

---

###### tags: `sql` `web`

# SQL Bases


[TOC]


# Find SQL Injection points

> Backend interacts with frontends

- http request-header  
    - get/post methods

So, we have to think about backend will catch what variables or information from the frontend 


# Check Injection-code to have  been executed

## Error
> Could try error syntax to know 

- SQL syntax ', "  (Let backend error and we could know this place has an injectable point

## Union
>Slove backend to hide the error message 
We could try to inquire by using Union syntax

## Time-blid

> Also, we could try to use sleep() function to know whether this place has an injectable point

# Mysql

![](https://i.imgur.com/yFdaDNT.png)

![](https://i.imgur.com/5ENzU3B.png)

![](https://i.imgur.com/9cqgKJG.png)

![](https://i.imgur.com/lXYOZal.png)

![](https://i.imgur.com/x5mqq6B.png)

# SQL database


## Create the table 


Example

```
CREATE TABLE Persons (
    PersonID int,
    LastName varchar(255),
    FirstName varchar(255),
    Address varchar(255),
    City varchar(255)
);
```




# SQL syntaxs

Mysql-comment
```mysql=
-- comments
/* comments */
# comments 
```


## Inquire syntaxs

### select

![](https://i.imgur.com/YW1JFe2.png)

### select distinc

> The statement is used to return the distinc value

![](https://i.imgur.com/roKf1ET.png)



## where 

where 
e.g. where id=1  (similar like if();
![](https://i.imgur.com/AA4c2Yc.png)
    
<> is !=
Negative operator
![](https://i.imgur.com/4B2HjW2.png)

---
between
![](https://i.imgur.com/5Tu1DMw.png)

---
in ()
Specify multiple values for the column
![](https://i.imgur.com/Ui7T6tR.png)

----
    
Search for pattern:
    like "%\<str>"    (%, Fuzzing search
    like "\<str>%"
![](https://i.imgur.com/0N8Inu0.png)
column like "%(str)%"
![](https://i.imgur.com/cxpA8cm.png)
"_" occupy one character
![](https://i.imgur.com/oOKKib1.png)

Remark:
    String also could compare 
![](https://i.imgur.com/HauPYSr.png)


## and, or, not
        
 
        
        
## order by \<keyword>

sort result in ascending or descending order
        
DESC:
To sort record in descending orider
![](https://i.imgur.com/NifPJKa.png)

## limit 
specify the number of records to return.
    
![](https://i.imgur.com/ifGy1FR.png)
        
## alias
To give a table, or a column in a table, a temporary name
alias column:
![](https://i.imgur.com/hDTxYSn.png)
        ![](https://i.imgur.com/kbXEhxU.png)

alias table:
![](https://i.imgur.com/Ha3kKL7.png)

alias name that combine many columns.
Mysql syntax(use concat() function to combine
![](https://i.imgur.com/QZZytA5.png)

as can be omitted.
![](https://i.imgur.com/AdBhzMG.png)


## Database();
the current database
![](https://i.imgur.com/AZmL3uM.png)

    
## user();
user,hostname information
![](https://i.imgur.com/kuhgIjH.png)


## @@datadir;
path
![](https://i.imgur.com/WaB032f.png)

Padding
![](https://i.imgur.com/ktokHq1.png)






## Exists()
賊好用 (手動猜東西
this operator is used to test the existence of the record in a subquery.


![](https://i.imgur.com/kfRi2nx.png)

## ascii()
Cooperate with select, we could display the ASCII encoding.

syntax: ascii(charactor)
return charactor 0xXX value 
![](https://i.imgur.com/dXIABc6.png)


## substring()
Extract substring from string.

substring("name",strat position, extract ？chararctors)

## union

Condition

- Union is used to combine two or more select statements
- echo of columns have similar data type. 


Conditions
- select statement within union must have the same of columns.

![](https://i.imgur.com/LwNQsqU.png)

```sql=
union all
```
Distinct values by default, so we have to use union all to show duplicate records. 

![](https://i.imgur.com/8FclJv2.png)

## count()

Display how many rows in this column 
![](https://i.imgur.com/gMPaQNc.png)

## group by

![](https://i.imgur.com/jMmEIVA.png)



# constant

## version()
![](https://i.imgur.com/PDKt5VM.png)

## @@basedir
![](https://i.imgur.com/WVl30fV.png)

## @@datadir
![](https://i.imgur.com/E5LCHZP.png)

## @@hostname
![](https://i.imgur.com/8pJRvAp.png)

## show root passwrod
![](https://i.imgur.com/FNN728Y.png)

## join

join is used to combined rows from two or more tables 

## inner join 
select record that having matching value in both tables
![](https://i.imgur.com/v4279nA.png)

![](https://i.imgur.com/Pxtegxu.png)

![](https://i.imgur.com/pdS0PTe.png)


## left join
![](https://i.imgur.com/uhcbcm0.png)

![](https://i.imgur.com/Oj5oV4c.png)

## right join
![](https://i.imgur.com/i6yhx13.png)
![](https://i.imgur.com/o9FZ6pi.png)




# Instances

```sql=
select * from customer where id =1 and updatexml(1,concat(0x7e,database(),0x7e,user(),@@datadir),1);#
```
![](https://i.imgur.com/uFqYlj0.png)
And we could know there could inject something.

---
>Remark:
SQL syntax 又長又粗又大又黑的 XD

既不知幾 也不知彼 就沒有紅顏知己XD




侯智晟 : )
Email: moweheckerouo@gmail.com
