As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity reference. What is an entity? Well... isn't this a combination of characters used to represent special characters. In HTML for example &ln is used to represent <.

Now, as I am new to the subject of computer security, can anybody help me in finding an attack that exploits these escape characters? I realize I have mentioned HMTL a lot. So there must be an exploit of HTML code that targets escape sequences. And I have heard the same is true for SQL. I don't know any particular escape sequences for SQL - is SQL injection considered an attack that makes use of escape characters? I mean SQL injection often targets the single quote.

  • So I am just thinking: Should an attacker place some malicious code in the URI section of a URL, they need to use escapse-sequences such as %3B for semicolon since the semicolon is a reserved character for the URI section... anyways, I am still really confused – user503842 Feb 20 '19 at 14:00

Consider this query:

SELECT * FROM users WHERE username='$username' AND password='$password';

Assume single qoutes are escaped, but the escape character \ is not. Then, use user\ as username and an SQL expression (OR 1=1 --) as password:

SELECT * FROM users WHERE username='user\' AND password=' OR 1=1 -- ';

Now, the database searches for a user with the username user' AND password=, or where one equals one. The quote starting the password value is now interpreted as closing the username value.

  • thank you so much Sjoerd, now I get it!!! – user503842 Feb 20 '19 at 17:05
  • Hey, I just noticed two points: You wrote: "Now, the database searches for a user with the username user' AND password= but I think you meant to say user AND password= ... second point: Shouldn't we escape the single quote that ends the password-value as well? I mean, is this expression: OR 1=1 -- '; correct? There is no single quote starting this expression. And can you tell me what the dashes -- are for? – user503842 Feb 24 '19 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.