不同类型数据库的报错信息

可以使用 '|"|}|) 等特殊字符进行检测，除了正常的参数提交外，注入的位置也可能存在于 HTTP header 中，比如 X-Forwarded-For、User-Agent、Referer、Cookie 中。不同数据库的报错内容：

MSSQL ASPX Error

Server Error in '/' Application

MSAccess (Apache PHP)

Fatal error: Uncaught exception 'com_exception' with message Source: Microsoft JET Database Engine

MSAccesss (IIS ASP)

Microsoft JET Database Engine error '80040e14'

Oracle Error

ORA-00933: SQL command not properly ended

ODBC Error

Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)

PostgreSQL Error

PSQLException: ERROR: unterminated quoted string at or near "'" Position: 1orQuery failed: ERROR: syntax error at or near"'" at character 56 in /www/site/test.php on line 121.

MS SQL Server: Error

Microsoft SQL Native Client error %u201880040e14%u2019Unclosed quotation mark after the character string

参考资料：

https://www.securityidiots.com/Web-Pentest/SQL-Injection/Part-2-Basic-of-SQL-for-SQLi.html