SELECT query by ORDER BY
Finding column number by **ORDER BY** can speed up the **UNION** SQL Injection process.
ORDER BY 1--
ORDER BY 2--
ORDER BY N-- so on
Keep going until get an error.
Error means you found the number of selected columns.