SQL injection using “True” or “Null”

Question

In a discussion about sql injections, a claim was made that the actress Rachel True has computer problems due to her last name, including not being able to get an iCloud account, and not being able to get an account on one of the largest social media sites. So apparently some blacklisting rejects her name. And there are supposedly some people with the last name “Null” with the same problem.

What I can’t figure out: Is there any way to use this name for an SQL injection? For example SELECT WHERE NAME = “True” misbehaving, or would that be just blacklisting being overzealous and refusing a name that posed no risk at all?

Answer 1

The error message in question doesn't say anything about SQL or blacklisting. It looks like a plain old bug, caused by the string "true" being misinterpreted as the boolean value true within the application code.

In general, yes, SQL databases like MariaDB and PostgreSQL use implicit type conversion which can lead to unexpected behavior -- and potentially security issues. For example, PostgreSQL happily converts the string "true" to a boolean true if necessary. There is no universal way of exploiting this, though, because such conversions only take place when the string is already used in a boolean context. So the input "true" in a query like ... WHERE lastname = input is treated as a string like any other input and has no special effects. The query would have to be in a form like ... WHERE lastname, which doesn't make a lot of sense. Of course such bugs can happen, but trying to fix this by blacklisting the string "true" would be absurd -- as absurd as applications which disallow common words like "select" or "where" in a misguided attempt at preventing SQL injections.

Answer 2

When names like "True" or "Null" are used in SQL queries, it may lead to problems in poorly built systems that do not adequately handle SQL injection protection and input validation. It should be made clear, nevertheless, that SQL injection vulnerabilities are more closely tied to the way user inputs are handled in SQL queries than they are to names.

Threat actors use a SQL injection attack to try and change a SQL query's structure by inserting malicious SQL code into inputs that the user has supplied and possibly obtain unauthorised access to data or carry out other harmful operations if a system is vulnerable however, the case you listed with the names "True" and "Null," are not so much related to direct SQL injection as they are to overzealous input validation or unintended side effects of badly constructed systems.

To reduce the risk of SQL injection, modern systems usually employ prepared statements or parameterized queries.

When someone with the last name "True" or "Null" has problems using some online services, it's more likely that these problems stem from the way those services handle it in their database operations or input validation than it is from SQL injection vulnerabilities perspective. Such problems might also result from, for example restrictions on how specific databases handle exceptional instances or reserved phrases.