The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

The UNION Operator

The 

UNION

operator is used in SQL to combine the results of two or more

SELECT

statements into a single result set. When a web application contains a

250

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 250

---

SQL injection vulnerability that occurs in a 

SELECT

statement, you can often

employ the 

UNION

operator to perform a second, entirely separate query, and

combine its results with those of the first. If the results of the query are

returned to your browser, then this technique can be used to easily extract arbi-

trary data from within the database.

Recall the application that enabled users to search for books based on

author, title, publisher, and other criteria. Searching for books published by

Wiley causes the application to perform the following query:

SELECT author,title,year FROM books WHERE publisher = ‘Wiley’

Suppose that this query returns the following set of results: