The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

arbitrary data from the database. You can achieve this by injecting a query

containing 

NULL

s as you did previously, and systematically replacing each 

NULL

with 

a

. For example, if you know that the query must return three columns, you

can inject the following:

‘ UNION SELECT ‘a’, NULL, NULL--

‘ UNION SELECT NULL, ‘a’, NULL--

‘ UNION SELECT NULL, NULL, ‘a’--

When your query is executed, you will see an additional row of data

containing the value 

a

. You can then use the relevant column to extract data

from the database.

N OT E

In Oracle databases, every 

SELECT

statement must include a 

FROM

attribute, and so injecting 

UNION SELECT NULL