# Finding Number of Columns

## Lab 9: SQL Injection - Finding Number of Columns

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F5lPnI87kIU0z9AM7wMRK%2Fimage.png?alt=media&#x26;token=9683c2fd-1260-4528-91b9-9ff545f191cb" alt=""><figcaption></figcaption></figure>

Go to User Lookup page <http://127.0.0.1/index.php?page=user-info.php>

in this case we need to find the number of columns, the idea is to user the SQL operator 'ORDER BY' to simulate a sorting of column, if we'll have a SQL error for the column with number columns\_number + 1, it means that the columns\_number tested was correct

Payload -> `' ORDER BY columns_number+1 #`&#x20;

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FD2iqKZZCuMjCjsZj7tWT%2Fimage.png?alt=media&#x26;token=bcb9b9cc-84a2-4b06-9c0b-cc8265c65ad5" alt=""><figcaption></figcaption></figure>

No SQL error, than 5 columns isn't the correct answer, continuing 10 is the correct answer because `' ORDER BY 11 #` payload generates a SQL error:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FIa3G9Nz6vd9h9AVQ1v4y%2Fimage.png?alt=media&#x26;token=ad3f4628-6263-46ec-bdae-e5b57ad46f9d" alt=""><figcaption></figcaption></figure>
