The following SQLi (MySQL) filter is from SQLi-Labs:
... $reg = "/#/" $reg1 ="/--/" $replace ="" $id=preg_replace($reg,$replace,$id); $id=preg_replace($reg1,$replace,$id); .... $sql = "SELECT * FROM users where id='$id' LIMIT 0,1";
I know the filter can be evaded by something like
However, I would like to see if it is possible to perform an outfile dump of the whole database, so I've tried things like:
' union select null,username,password from users into outfile "/tmp/file"...
however due to the
' LIMIT 0,1 at the end I'm having trouble figuring out how to end the payload. I've thought about doing multiple union queries, say:
' union all select null,username,password from users into outfile "/tmp/file" union all select null,username,password from users group by '
However, I get an error, because I believe the
into outfile part has to be the last query. I also thought about using
FIELDS TERMINATED BY ' but now the
LIMIT 0,1 is in my way.
Is there anyway around this to perform a outfile dump of the database? Is it possible to dump the database through the error instead?