The problem with your approach is that PHP is not going to (Okay, as pointed out below in the comments, it is possible, but it is unlikely) execute more than one simultaneous query and as you are closing off the initial query with a semi-colon, then trying to create a new one at the start of the
SELECT. You would have to
UNION ALL them.
username'; SELECT * FROM users;
Should be similar to:
username='admin' UNION ALL SELECT CONCAT(username, 0x3A, password) AS details FROM users LIMIT 0,1;
Read this link for MySQL's UNION syntax http://dev.mysql.com/doc/refman/5.0/en/union.html
There are two main types of SQL Injection, they are Blind and Error-based.
Blind is where you will not get any output from the given query, you may just notice a piece of text or image or something else missing from the page, and you have to enumerate through various options to get the desired result.
Error-based is, as the name suggests, where the script will throw an error, and you can see exactly what you need to do. You will see the result of the injection somewhere on the page or in the source code of the page at least.
In all cases, you should be able to use MySQL's
INTO OUTFILE syntax to output the query results into a file, assuming you have the right permissions to do so.
This is for most cases of MySQL injection, however, there are more than two types of SQLi, but for purposes of this conversation, they are the main ones you need to know about.
This is a good tutorial on SQL injections: http://www.exploit-db.com/papers/13045/