MYSQL updatexml() function error injection analysis

First, understand the updatexml() function

UPDATEXML (XML_document, XPath_string, new_value);

The first parameter: XML_document is in String format and is the name of the XML document object, Doc in this article.

The second parameter: XPath_string (a string in Xpath format). If you don’t understand Xpath syntax, you can find a tutorial online.

The third parameter: new_value, in String format, replaces the found data that meets the conditions

Function: Change the value of the node that meets the conditions in the document

Change the value of XPATH_string in XML_document

And our injection statement is:

updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)

The concat() function concatenates them into a string, so it does not conform to the format of XPATH_string, resulting in a format error.

ERROR 1105 (HY000): XPATH syntax error: ':root@localhost'

Summary of xpath syntax format: https://www.jb51.net/article/125607.htm

Summarize

The above is all the content of this article about MYSQL updatexml() function error injection analysis. I hope it will be helpful to everyone. Interested friends can refer to: Detailed explanation of MySQL prepare principles, several important MySQL variables, methods of deleting MySQL table data, etc. If you have any questions, you can leave a message at any time. Everyone is welcome to communicate and discuss. I would also like to thank my friends for their support of this site.