The traditional in-band method in INSERT, UPDATE injections would be by fixing the query. For example in INSERT statements one can simply fix the query, comment out the rest and extract the data once it is echoed out by the application. Same goes with the UPDATE statement, but only if the query has more than one column we can fix the query. What if we face a situation where UPDATE or INSERT has one column or simply we don’t know the exact query to fix? What if mysql_error() is not echoed out? This paper discusses how this works in-depth.
You can download it from the following link: https://packetstormsecurity.com/files/download/140936/sqlinjection-insertupdate.pdf
Source: https://packetstormsecurity.com/files/140936/Extracting-Data-From-UPDATE-And-INSERT.html