I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION]

When I control the SORT_DIRECTION, which is normally ASC or DESC, how do I turn this into a blind SQL injection?

  • how about UNION SELECT * FROM z WHERE ...? does it have to be blind? if you can't see the output there's no point letting you control the sort order Commented Oct 12, 2020 at 12:15
  • 2
    I don't think union is going to work, the ORDER BY clause would have to go at the end of the statement. The ORDER BY clause can nonetheless be exploited, see for example: notsosecure.com/injection-in-order-by-clause
    – Kate
    Commented Oct 12, 2020 at 19:52

1 Answer 1


Found a partial solution:

,if(1=(select 1 regexp if(1=1,1,0x00)),1,1) = TRUE
,if(1=(select 1 regexp if(1=2,1,0x00)),1,1) = FALSE [error]

Works with version() but not with subqueries using SELECT.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .