The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Submit a single quotation mark as the item of data you are targeting.

Observe whether an error occurs, or whether the result differs from 

the original in any other way. If a detailed database error message is

received, consult the “SQL Syntax and Error Reference” section of this

chapter to understand its meaning.

■

If an error or other divergent behavior was observed, submit two single

quotation marks together. Databases use two single quotation marks as

an escape sequence to represent a literal single quote, so the sequence

is interpreted as data within the quoted string rather than the closing

string terminator. If this input causes the error or anomalous behavior to

disappear, then the application is probably vulnerable to SQL injection.

■

As a further verification that a bug is present, you can use SQL concate-