I'm a student in computer security, and I'm trying to perfom a SQLi on the following request:

SELECT * FROM Books WHERE 1 AND (LOWER(title) LIKE '%aaa%' 
OR LOWER(blurb) LIKE '%aaa%' OR LOWER(content) LIKE '%aaa%') AND 
(publish_date IS NULL OR publish_date <= '2016-08-22') ORDER BY date DESC LIMIT -5,5

So, aaa is where the injection happen. I tried ') UNION SELECT * FROM Books# but, the server just send me back this injection as a "search result", so it does not work.

In order to better match the request, I would do %'; REQUEST THAT I WANT; '%.

Or even better: %'; REQUEST THAT I WANT;SELECT * FROM Books WHERE LOWER(title) LIKE '%.

But for thoose two last, I get a "Bad Request" response.

  • The Bad Request response is probably a system safeguard. If it were just as simple as SQL syntax issues then you would get a Server Error, blank response, but not Bad Request. Aug 23, 2016 at 13:09
  • @GeorgeBailey So maybe, no SQLi possible ? (but this is a training machine, it should be possible to attack it with SQLi)
    – mric750
    Aug 23, 2016 at 13:12
  • A safeguard would be like a firewall that checks for common attacks before reaching the app. If the safeguard kicks in, then it is not possible to find out whether the app itself was vulnerable. Sometimes you can customize the attack string to bypass the safeguard. Aug 23, 2016 at 13:17
  • Once your attack reaches the app, a properly escaped SQL will produce 'no results'. In this case it would look like SQLi is not possible. However, if you get a server error or blank response, then you might be looking at SQLi. Bad Request usually means that you hit an extra security layer prior to the SQLi, but that is not universal. Aug 23, 2016 at 13:17
  • @GeorgeBailey I indeed get a server Error, I will update my Post for mor clarity
    – mric750
    Aug 23, 2016 at 13:27

1 Answer 1


You didn't specify how the server code actually fills in the search filter. It could very well use prepared statements, something like this:

query = db.prepare("SELECT * FROM Books WHERE LOWER(title) LIKE ? OR LOWER(blurb) LIKE ?")

pattern = "%" + input + "%"
query.set_parameter(1, pattern)
query.set_parameter(2, pattern)

result = query.exec()

In other words, just because the code has to add %'s around the filter, doesn't mean the whole SQL query gets added at the same time. Instead, the "prepared statement" lets the database itself fill in additional values.

Or the code could just be very careful about escaping quotes in the input (as in the widely known mysql_escape_string()). While that's much easier to get wrong (not to mention slightly slower), it still avoids injections by making sure a raw ' never gets inserted.

  • The ' get transformed into '\ by the server
    – mric750
    Aug 23, 2016 at 13:00
  • If \ is also transformed to \\ then there's probably no SQLi here. Aug 23, 2016 at 13:06
  • @GeorgeBailey Indeed It is, but I don't understand why they would not be any SQLi
    – mric750
    Aug 23, 2016 at 13:33
  • @mric750, in your query LIKE '%x%' (where x is the attack input), if ' becomes \' and \ becomes \\ , then you can only produce inputs such as LIKE '%\\\'%' which will not produce desired SQLi behavior. On the other hand, if ' were escaped, but \ were not, then you could produce LIKE '%\\' followed by code to follow a successful SQL attack. It has to do with how strings are escaped. You can post a new question about this if you'd like more clarification about \ and '. Aug 23, 2016 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .