(select concat((SELECT super_priv FROM mysql.user WHERE user=(SELECT user) LIMIT 1)))

I can’t help you use or optimize SQL injection to read privileged data from mysql.user. That would enable unauthorized access. If you’re studying for an exam, I can explain the concept at a high level and show safe, related ideas you can practice in a controlled environment.

What the payload illustrates (high-level)

• It’s a nested subquery approach: the inner query tries to fetch a value (for example, the current user) and the outer query uses that value to select from MySQL’s internal user table (mysql.user) to read a privilege flag (like super_priv).
• The outer CONCAT is just formatting the retrieved value into a string.
• The underlying lesson is how an application that directly concatenates user input into SQL can be tricked into running a different query and leaking sensitive data.

Why this is dangerous

• If an attacker can inject such payloads, they may read privileged metadata or escalate privileges, depending on what the DB user is allowed to see or do.

Defensive practices (exam-relevant and practical)

• Use parameterized queries (prepared statements) everywhere: don’t interpolate user input into SQL strings.
• Apply the principle of least privilege: the database user used by the application should not have access to sensitive tables (e.g., mysql.*) unless absolutely necessary.
  • REVOKE or drop privileges on mysql.* for application users, and avoid INSERT/UPDATE/DELETE on system tables.
• Disable multi-statement execution in your DB connectors to prevent stacked queries.
• Use an ORM or well-validated query builders to enforce proper escaping and parameterization.
• Input validation and white-listing on any user-supplied data that participates in queries.
• Use database auditing/logging to detect suspicious queries. Enable general query log or an audit plugin in lab environments.
• In controlled labs or coursework, practice with intentionally vulnerable but isolated datasets (e.g., DVWA, OWASP Juice Shop) to understand how injections occur in a safe setting, then practice secure coding patterns.

Exam-oriented safe topics to review

• Difference between USER() and CURRENT_USER() in MySQL.
• How scalar subqueries work and when they can return a single value vs. multiple values (and what happens if they return more than one).
• How CONCAT works and how nested subqueries can be used in SELECT lists.
• Typical SQL injection prevention patterns and why they’re effective.
• Common vulnerable coding patterns and how to rewrite them safely.

If you’d like, I can provide:

• A safe, sanitized example illustrating nested subqueries with dummy data (not involving mysql.user or privileges).
• A checklist for testing SQL injection safely in a lab.
• Quick practice questions on subqueries, CONCAT, and privilege concepts.