When an application is vulnerable to SQL injection, and the results of the query are returned within the application's responses, you can use the UNION ...