Select Null,null,null,null,null,null-- Gojb: {keyword} Union All

: The database executes: SELECT col1, col2, col3, col4, col5, col6 FROM products WHERE name = '' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL--' .

: For a UNION to work, the second query must have the exact same number of columns as the first query. 3. SELECT NULL,NULL,NULL,NULL,NULL,NULL : The database executes: SELECT col1, col2, col3,

: By using six NULL values, the attacker is testing if the original query has exactly six columns. : The database executes: SELECT col1

: A website takes user input and places it directly into a SQL query without "cleaning" it first. : The database executes: SELECT col1, col2, col3,

: The attacker wants the database to return the results of the original query plus the results of their injected query.

: NULL is used because it is compatible with almost any data type (integers, strings, dates, etc.).