SQL injection! 💉
After finding the number of columns using the NULL trick, you can take it a step further and identify which column takes which data type.
Swap 'abc' into one position at a time. The one that comes back without an error is your string column, and that's where
