SQL Injection Attacks and Defense - 2009

322 Chapter 7 • Advanced Topics
Table 7.1 Continued. Standard and
Non-Standard Unicode Encodings of Some Useful Characters
Literal Character
Encoded Equivalent
( %u0028
%uff08
%c0%28
%c0%a8
%e0%80%a8
) %u0029
%uff09
%c0%29
%c0%a9
%e0%80%a9
* %u002a
%uff0a
%c0%2a
%c0%aa
%e0%80%aa
[space] %u0020
%uff00
%c0%20
%c0%a0
%e0%80%a0
Using Dynamic Query Execution
Many databases allow SQL queries to be executed dynamically, by passing a string containing
an SQL query into a database function which executes the query. If you have discovered
a valid SQL injection point, but find that the application’s input filters are blocking queries
you want to inject, you may be able to use dynamic execution to circumvent the filters.
Dynamic query execution works differently on different databases. On Microsoft SQL
Server, you can use the EXEC function to execute a query in string form. For example:
EXEC('SELECT password FROM tblUsers')
In Oracle, you can use the EXECUTE IMMEDIATE command to execute a query in
string form. For example:
DECLARE pw VARCHAR2(1000);
BEGIN
EXECUTE IMMEDIATE 'SELECT password FROM tblUsers' INTO pw;
DBMS_OUTPUT.PUT_LINE(pw);
END;