How does union select statement output vulnerable columns in sql injection
Consider a SQL vulnerable site.
Let the number of columns in the query be 3.
So the statement goes, www.test.com?php.id=-1' union select 1,2,3 --+-
My understanding of this statement is like this.
There are 2 statements Union is used to join both statements. (-) is used to null the value of the first statement. ' is used to break the query and input a second statement and --+- is used to comment out the rest of the statement. Upon inputting this statement, The website displays 2 and 3 as vulnerable columns.
What I don't get is that how a select statement displays the vulnerable columns.