The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

hash character to specify a comment.

242

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 242

---

T I P

In some situations, an alternative way to handle the trailing quotation

mark without using the comment symbol is to “balance the quotes” by

concluding the injected input with an item of string data that requires a trailing

quote to encapsulate it. For example, entering the search term

Wiley’ OR ‘a’ = ‘a

will result in the query

SELECT author,title,year FROM books WHERE publisher = ‘Wiley’ OR ‘a’=’a’

which is perfectly valid and achieves the same result as the 

1 = 1

attack.

The previous example may appear to have little security impact, because

users can probably access all book details using entirely legitimate means.

However, we will describe shortly how many SQL injection flaws like this can

be used to extract arbitrary data from different database tables, and to escalate

privileges within the database and the database server. For this reason, any

SQL injection vulnerability should be regarded as extremely serious, regard-

less of its precise context within the application’s functionality.