不同類型數據庫的報錯信息

可以使用 '|"|}|) 等特殊字符進行檢測，除了正常的參數提交外，注入的位置也可能存在于 HTTP header 中，比如 X-Forwarded-For、User-Agent、Referer、Cookie 中。不同數據庫的報錯內容：

MSSQL ASPX Error

Server Error in '/' Application

MSAccess (Apache PHP)

Fatal error: Uncaught exception 'com_exception' with message Source: Microsoft JET Database Engine

MSAccesss (IIS ASP)

Microsoft JET Database Engine error '80040e14'

Oracle Error

ORA-00933: SQL command not properly ended

ODBC Error

Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)

PostgreSQL Error

PSQLException: ERROR: unterminated quoted string at or near "'" Position: 1orQuery failed: ERROR: syntax error at or near"'" at character 56 in /www/site/test.php on line 121.

MS SQL Server: Error

Microsoft SQL Native Client error %u201880040e14%u2019Unclosed quotation mark after the character string

參考資料：

https://www.securityidiots.com/Web-Pentest/SQL-Injection/Part-2-Basic-of-SQL-for-SQLi.html