SQL Injection Attacks and Defense - 2009

References • Chapter 10 441
When quote characters are being filtered or sanitized you will need to encode string
values to prevent them from being corrupted by the filter. Table 10.18 lists the alternative
methods for representing the query SELECT ‘ABC’ within each of the most popular
database platforms.
Table 10.18 Representing Strings without Quote Characters
Platform
Microsoft SQL Server
MySQL Server
Oracle
Query
SELECT char(0x41) + char(0x42) + char(0x43);
SELECT char(65,66,67);
SELECT 0x414243;
SELECT chr(65) || chr(66) || chr(67) from dual;
Select concat(chr(65),concat(chr(66),chr(67))) from dual;
Select upper((select substr(banner,3,1)||substr(banner,
12,1)||substr(banner,4,1) from v$version where
rownum=1)) from dual;
Microsoft SQL Server also allows you to build your query within a variable and then
call EXEC to execute it. In the following example, we have created a variable named @q
and placed the query SELECT ‘ABC’ into it via a HEX-encoded string:
DECLARE @q varchar(8000)
SELECT @q=0x53454c454354202741424327
EXEC(@q)
You can adopt this technique to execute any query without submitting any quote
characters to the application. You can use the following Perl script to automatically encode
SQL statements using this technique:
#!/usr/bin/perl
print "Enter SQL query to encode:";
$teststr=;chomp $teststr;
$hardcoded_sql =
'declare @q varchar(8000) '.
'select @q=0x*** '.
'exec(@q)';
$prepared = encode_sql($teststr);
$hardcoded_sql =∼s/\*\*\*/$prepared/g;
print "\n[*]-Encoded SQL:\n\n";
print $hardcoded_sql ."\n";