SQL Injection Attacks and Defense - 2009

224 Chapter 5 • Blind SQL Injection Exploitation
Wa r n in g
Logical operators, although useable, are not suitable for numeric parameters
as they depend on the value of .
Table 5.1 Split and Balanced Strings with Subquery Placeholders
Database Numeric Parameter String Parameters Date Parameters
MySQL
SQL Server
Oracle
(…)
is
one of:
+ – * /
& | ^ xor
(…)
is
one of:
+ – * /
& | ^
(…)
is
one of:
+ – * / ||
Not possible to split
and balance without
side effects. Subqueries
can be easily executed,
but this would change
the result of the
query.
If the MySQL
database was
started in ANSI
mode, the || operator
is available for string
concatenation in
subqueries:
'
|| (…) ||
'
'
+ (…) + '
'
|| (…) ||
'
must be
rewritten to
remove non-numeric
characters; e.g.,
2008-12-30 becomes
20081230.
Where the date is
treated as a string
in the SQL query:
'
(…)
Where the date is
treated as a number
in the SQL query:
(…)
is
one of:
+ – |
|| ^ xor
'
+ (…) +
'
'
|| (…)
|| '