I am currently studying SQLi from a book which I won't mention to avoid any copyright issues. The book contains many examples of strings / code from MSSQL, MySQL, Oracle etc.
I am currently stumped as to what the equivalent syntax would be in PHP/MySQL for this example, given only in .asp (assuming a DB of MSSQL). This is an injection string as used in the browser's address bar, using
ORDER BY to enumerate the number of columns in a table, iterating through
ORDER BY 1,
ORDER BY 2 etc. until producing an error:
So, would the equivalent syntax in PHP/MySQL be something like:
hxxp://someserver.com/products.php?id=12 order by 1
I'm thinking whitespace is OK here? Or perhaps:
I have written an application for XAMPP in order to test, but an unable to produce an error, so I'm checking to make sure that I'm using the correct syntax.
To be clear, for the present post, I'm really only asking about syntax.
Edit: I thought I was very clear that I was only asking about whitespace in a URL... I did produce the error I was looking for.
I have found an instance where a space vs
%20 do not produce the same results - as the very last character in a URL.
This (note the single space after the two hyphens):
/victim/products.php?val=100' ORDER BY 4 --
Database access failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1.
/victim/products.php?val=100' ORDER BY 4 --%20
Database access failed: Unknown column '4' in 'order clause'.
I know that the very same build of XAMPP has no problem with a space after 2 hyphens at the end of an injection when it's in a login field using the POST method...