SQL Injection Attacks and Defense - 2009

Testing for SQL Injection • Chapter 2 53
Injecting attacker’ is clearly going to generate an error, as the SQL statement is incorrect
due to the extra single quote at the end:
SELECT *
FROM products
WHERE category='attacker''
However, you can try to inject something that doesn’t generate an error. This is usually
an educated trial-and-error process. In our example, we need to keep in mind that we are
trying to inject data into a string enclosed with single quotes.
What about injecting something such as bikes’ or ‘1’=’1? The resultant SQL statement
would be:
SELECT *
FROM products
WHERE category='bikes' OR '1'='1' /* always true -> returns all rows */
In this example, we injected SQL code that created a meaningful correct query. If the
application is vulnerable to SQL injection, the preceding query should return every row in
the products table. This technique is very useful, as it introduces an always true condition.
‘ or ‘1’=’1 is inserted inline with the current SQL statement and does not affect the
other parts of the request. The complexity of the query doesn’t particularly matter, as we can
easily create a correct statement.
One of the disadvantages of injecting an always true condition is that the result of the query
will contain every single record in the table. If there are several million records, the query
can take a long time to execute and can consume many resources of the database and Web
servers. One solution to this is to inject something that will have no effect on the final result;
for example, bikes’ or ‘1’=’2. The final SQL query would be:
SELECT *
FROM products
WHERE category='bikes' OR '1'='2'
Because 1 is not equal to 2, and therefore the condition is false, the preceding statement
is equivalent to:
SELECT *
FROM products
WHERE category='bikes'
Another test to perform in this kind of situation is the injection of an always false
statement. For that we will send a value that generates no results; for example, bikes’
AND ‘1’=’2:
SELECT *
FROM products
WHERE category='bikes' AND '1'='2' /* always false -> returns no rows */