When results are rendered, UNION-based injection reads the whole database out through the page.

UNION-based SQL injection

When the application prints query results, UNION SELECT lets you print your own.