New DNS Out-of-Band vector for MSSQL Injections in SELECT statement! Can be used for completely blind #sqli.

Use fn_trace_gettable and Burp Collaborator