String sql injection vs sql injection

Question

What's the difference between normal sql injection and string based sql injection? An example would be appreciated.

As far as I understand from the few readings around the net, string based sql injection is somewhat similar to blind sql injection in that, the sql injection occurs but a valid page is returned and we cannot see the result of the query. But, based on string sql injection we can force the webpage to return an error and the result of the query will be revealed with the error message! can anyone confirm this, and give and example.

EDIT: some of the websites out there are defining the terms as explained above, check this http://zerofreak.blogspot.co.uk/2012/03/tutorial-by-zer0freak-difficulty-easy.html?m=1 but this doesn't seem to be valid!

Answer 1

There are actually cases in which an SQL injection is blind, so it doesn’t return any explicit data, and known techniques on blind SQL injections fail due to the fact that the result has no direct impact on the program’s behavior. So one cannot extrapolate from the behavior to the data.

However, in order to have your scenario actually working, that the result of the blind SQL injection is shown in an error message, the query must have been executed successfully as otherwise it wouldn’t return any results (especially not those of the injected code). So there must be something else that uses the result and fails.

This can be another SQL statement that uses the selected values of a former SQL statement. Like the following:

SELECT vendor_id FROM products WHERE id = $product_id

And later:

SELECT name FROM vendors WHERE id = $vendor_id

Now if you make the first SELECT statement select anything other than a value that is valid in the second statement, i. e., the result of @@version:

product_id: 0 UNION SELECT @@version

Which results in:

SELECT vendor_id FROM products WHERE id = 0 UNION SELECT @@version

Then the second query would fail as, e. g., 5.5.32-standard is not recognized as valid in the resulting second SQL statement:

SELECT name FROM vendors WHERE id = 5.5.32-standard

Here is the corresponding error message reported by MySQL, including the failed statement with the value of @@version:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.32-standard' at line 1: SELECT name FROM vendors WHERE id = 5.5.32-standard

This sure can be used to turn a blind SQL injection into a non-blind one. And this can also happen with other routines that use the selected value and report errors containing the selected value.

By the way, I’ve never heard of a distinction between these kind of injections. One might rather say it’s error-based as an error message reveals the information. However, some may call this also a second order SQL injection as the injection happens in a second step. This example does also show that it isn’t sufficient to simply “sanitize all user inputs” as it’s not in the input where the injection happens but in the output into the SQL statement.

Answer 2

Edit: in light of OP's reference to Blind SQL Injection

I can't see any way in which "string based SQL injection" could be interpreted specifically as a form of blind SQL injection. Blind SQL injection can occur on any data type, not just strings. Of course it can be string-based, but no more so that normal SQL injection can.

Admittedly, there are at least a couple of articles online but I believe these have confused the term. E.g.

• http://zerofreak.blogspot.co.uk/2012/03/tutorial-by-zer0freak-difficulty-easy.html?m=1

• http://youtu.be/JezijO2mPh8

Articles from more reliable source like OWASP don't seem to make any link between the terms "string based" and "blind", but please feel free to correct me. Furthermore, your question seems to describe what is known as Error-Based SQL Injection which isn't blind, nor is it specifically "string based".

Nevertheless, here is my original answer that covers SQL Injection of strings in comparison to other data types...

---

This comes down to where the vulnerable parameter is being injected; more specifically, whether it's being injected inside quotes (a string) or otherwise (e.g. integers, timestamps etc).

For example, consider the following URL:

http://www.example.com/search?id=23&txt=my+search+string

Now let's assume that these feed into a query dynamically via PHP as follows:

$id = $_GET('id');
$txt = $_GET('txt');
$querystring = "SELECT * FROM items WHERE id = $id OR txt = '$txt'"

If $querystring were then to be executed in SQL, in this case both parameters would be vulnerable (they have been concatenated without validation or sanitisation).

However, the txt parameter is contained within quotes ', meaning that in order to execute arbitrary SQL statements, you would first need to escape the string by including a ' character (i.e. we end the string ourselves so that our SQL is included afterwards). This is because anything inside the quotes is part of the search string, and therefore won't be executed.

For example:

http://www.example.com/search?id=23&txt='+OR+1=1--

This would result in a $querystring that looked like:

SELECT * FROM items WHERE id = 23 OR txt = '' OR 1=1--'

So we've 'escaped' the string by injecting our own '. Therefore, this case relies heavily on being able to include the ' character.

Whereas the id parameter just needs some whitespace:

http://www.example.com/search?id=23+OR+1=1--&txt=my+search+string

...

SELECT * FROM items WHERE id = 23 OR 1=1 OR txt = 'my search string' 

Answer 3

I know there is already an accepted answer and that this question is a little old, but I think that there is a misunderstanding here.

String-based SQL injection has nothing to do with blind injection.

In the many tutorials out there, they say that when

http://example.org/index.php?id=12+order+by+1000--

doesn't work because it doesn't give you an error, you can try

http://example.org/index.php?id=12'+order+by+1000--+

This is not a new technique. There's nothing magic about it.

Very simply, the first url isn't effective because, even if the param is a number, the code on the server treats it as a string. Your code is injected between two single quotes:

SELECT id, author FROM news WHERE id = '12' order by 1000-- '

Note that that last + is important because in MySQL the two hyphens must be followed by a whitespace or a control character (see here).

So adding a single quote and a plus is not some magic method which forces a site to display an error.

Answer 4

The principles are the very same both exploit how strings are handled to abuse the database and obtain data or gain access to a site.

The only difference is that when people is talking about "string based SQL injection" (or blind SQL injection) they usually refer to a server that is vulnerable to this attack but you don't receive any hints on what is going on hence you might receive a valid web page but it really is vulnerable so you have to take a different approach.

If you use something like:

http://example.org/index.php?id=potato order by 10--

You receive the normal web page, but when you use:

http://example.org/index.php?id=potato' order by 10--+

Note the ' and the +. Here you receive an error and with that the answer to your DB query.

You can have further readings about SQL Injection in this very nice OWASP tutorial.