I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do this by "Ordinal" ordering the result set. So, I start with ORDER BY 1, .. BY 2, and so on until I get an error returning 'Unknown column'. Now, for an injection like so:

localhost/sqli?id=2' order by 7 AND '1

The resulting SQL statement is:

mysql> SELECT * FROM table_name where id='2' order by 7 and '1';

This returns a result set, but I was expecting it to throw an error returning "unknown column '7' in 'order clause' ". Why does it not throw the error. The table that I am working with has only 3 columns.

  • Not sure why it doesn't error out, but I think what you'd want to do is comment out the remainder so your order by is the last part of sql. I.e. localhost/sqli?id=2' order by 7 --
    – LB2
    Commented Apr 24, 2014 at 19:30
  • The scenario is that commenting out the rest of the SQL isn't an option. This is the video tutorial I am following - youtube.com/watch?v=0tyerVP9R98 Commented Apr 24, 2014 at 19:34
  • Try running EXPLAIN on the query: EXPLAIN SELECT * FROM table_name where id='2' order by 7 and '1';
    – user43488
    Commented Apr 24, 2014 at 19:39
  • 1
    Running EXPLAIN on it returns - id 1, select_type SIMPLE, table table_name, type const, possible_keys PRIMARY, key PRIMARY, key_len 4, ref const, rows 1, Extra NULL. I am not sure what to make of the output. Commented Apr 24, 2014 at 19:47

2 Answers 2


If you look at the syntax of ORDER BY clause for the SELECT statement, it states:

[ORDER BY {col_name | expr | position}
  [ASC | DESC], ...]

So you either specify a columns name (col_name), an expression (expr), or a column position (position), where column positions are integers.

Now if you compare this syntax with your ORDER BY clause:

… order by 7 and '1'

7 and '1' is an expression, consisting of an AND operation with 7 and '1' as operands.

However, the following works as expected:

… order by 7, '1'

Where 7 is a column position and '1' is an expression.


I think enumerating the number of columns is not what this is doing because for that we don't need a "'" in the order by injection as we don't want the application to throw an error except when the injection exceeds the number of columns in the original select statement. Moreover, I think you should use commenting out the rest of the statement after order by.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .