Part 3 of our PortSwigger Web Security Academy series. Part 2 sketched the four SQL injection shapes at a bird's-eye view. This post drills into one of them: the UNION attack. It is one of the most useful shapes to understand because it converts a small SQLi foothold into an "I can read anything in the database" primitive.

Wiki reference: SQL Injection/UNION Attack.

The Idea

Say a page runs

SELECT name, description FROM products WHERE category = 'Gifts'

The columns you can see in the response are name and description, because that is what the query is selecting. UNION lets …