看到OrhanAlbay@分享的一个在基于出错回显的SQL Inject中，发现列数的tips,仅需2步

[出自:jiwo.org]

本地测试：

mysql>  CREATE TABLE pet (name VARCHAR(20), owner VARCHAR(20), species VARCHAR(20), sex CHAR(1), birth DATE, death DATE);

Query OK, 0 rows affected (0.01 sec)

mysql> select * from pet order by 5,10,15;
ERROR 1054 (42S22): Unknown column '10' in 'order clause'

说明列数在5-10之间

mysql> select * from pet order by 6,7,8,9,10;
ERROR 1054 (42S22): Unknown column '7' in 'order clause'
确切数字为6