SQL注入方法之：获取列名

select col_name(object_id('table'),1) from sysobjects where name='table'