Q:

Null character in Sql Injection

Going through sql injection on hakipedia, i understand that the injections are assumed to go along a parameter (which becomes a part of the sql query at the server end).
e.g.
select news from news_table where id=1

is attacked as
select news from news_table where id=NULL UNION ALL select * from users

However, in information schema (http://hakipedia.com/index.php/SQL_Injection#INFORMATION_SCHEMA) and Mysql Benchmark (http://hakipedia.com/index.php/SQL_Injection#MySQL_BENCHMARK) injection vector the NULL before UNION ALL is not explicitly stated. Is this correct or am i missing something?

A:

The NULL is just used to make the starting query valid. Those are probably just examples to use as starting points. You may need to tweak the attack for different queries. For example, if the query ends with a string parameter:
... where id = 'abc'

The code may look something like this:
"... where id = '${id}'"

The attack would need to correctly terminate that statement to make it valid SQL. Something like this may work:
' UNION ALL select * from users --

Which would result in:
... where id = '' UNION ALL select * from users --'

The NULL example would probably not work here. It would result in something like this:
... where id = 'NULL UNION ALL select * from users'

