Sql+injection+challenge+5+security+shepherd+new !!top!! -

: Attackers first use ORDER BY clauses to figure out how many columns the original query is returning.

If true, column flag exists.