I have a webpage which is vulnerable to SQL injection.
As I know the number of columns so I inserted
'union select 1,db_name(),3,4,5--
and got database name listed in the second column of a table which has five columns (I am talking about html table here). My question is how can I see the result (in the html table) of a query which looks something like
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’)
Is there anything which I should learn about sub-queries?