SQL Injection Attacks and Defense - 2009

442 Chapter 10 • References
sub encode_sql{
@subvar=@_;
my $sqlstr =$subvar[0];
@ASCII = unpack("C*", $sqlstr);
foreach $line (@ASCII) {
$encoded = sprintf('%lx',$line);
$encoded_command .= $encoded;
}
return $encoded_command;
}
HTTP Encoding
You can sometimes bypass input validation filters that reject known bad characters
(often referred to as blacklisting) by encoding your input using exotic encoding standards
or via double encoding. Table 10.19 lists common SQL metacharacters in a number of
encoded formats.
Table 10.19 Encoded SQL Metacharacters
Character
Encoded Variants
' %27
%2527
%u0027
%u02b9
%ca%b9
" %22
%2522
%u0022
%uff02
%ef%bc%82
; %3b
%253b
%u003b
%uff1b
%ef%bc%9b
( %28
%2528
%u0028
%uff08
%ef%bc%88
Continued