Edit: in light of OP's reference to Blind SQL Injection
I can't see any way in which "string based SQL injection" could be interpreted specifically as a form of blind SQL injection. Blind SQL injection can occur on any data type, not just strings. Of course it can be string-based, but no more so that normal SQL injection can.
Admittedly, there are at least a couple of articles online but I believe these have confused the term. E.g.
Articles from more reliable source like OWASP don't seem to make any link between the terms "string based" and "blind", but please feel free to correct me. Furthermore, your question seems to describe what is known as Error-Based SQL Injection which isn't blind, nor is it specifically "string based".
Nevertheless, here is my original answer that covers SQL Injection of strings in comparison to other data types...
This comes down to where the vulnerable parameter is being injected; more specifically, whether it's being injected inside quotes (a string) or otherwise (e.g. integers, timestamps etc).
For example, consider the following URL:
http://www.example.com/search?id=23&txt=my+search+string
Now let's assume that these feed into a query dynamically via PHP as follows:
$id = $_GET('id');
$txt = $_GET('txt');
$querystring = "SELECT * FROM items WHERE id = $id OR txt = '$txt'"
If $querystring
were then to be executed in SQL, in this case both parameters would be vulnerable (they have been concatenated without validation or sanitisation).
However, the txt parameter is contained within quotes '
, meaning that in order to execute arbitrary SQL statements, you would first need to escape the string by including a '
character (i.e. we end the string ourselves so that our SQL is included afterwards). This is because anything inside the quotes is part of the search string, and therefore won't be executed.
For example:
http://www.example.com/search?id=23&txt='+OR+1=1--
This would result in a $querystring
that looked like:
SELECT * FROM items WHERE id = 23 OR txt = '' OR 1=1--'
So we've 'escaped' the string by injecting our own '
. Therefore, this case relies heavily on being able to include the '
character.
Whereas the id parameter just needs some whitespace:
http://www.example.com/search?id=23+OR+1=1--&txt=my+search+string
...
SELECT * FROM items WHERE id = 23 OR 1=1 OR txt = 'my search string'