10

I was doing some homework for my security class involving SQL injections. I found that I could do a shorter SQL injection than the typical ' OR '1'=1 example. Instead I could do '='. Typing this is in to the password field of a typical login boxes gives a SQL query like this:

SELECT * FROM Users WHERE username='user' AND password=''='';

It turns out that password=''='' evaluates to 1, allowing the SQL injection to work.

After doing some more testing, I saw that if I test if a string is equal to 0, it returns 1:

SELECT 0='a';

So in my example, password='' would evaluate to 0 and 0='' would end up evaluating to 1.

My testing showed me how this is happening, but I want know why this happens (i.e why is 0='a' true?.

1

3 Answers 3

6

As documented under Type Conversion in Expression Evaluation, comparisons between a string and an integer will be performed numerically:

  • In all other cases, the arguments are compared as floating-point (real) numbers.

Therefore, the operands are converted to floating-point numbers and then compared.

Conversion of a string to a float will consider every numeric character (and the first period or exponentiation character) encountered up to the first non-numeric character. Therefore 'hello' or 'a' will be truncated to '' (and thereby cast to zero) whereas '123.45e6foo789' would truncate to '123.45e6' (and thereby cast to 123,450,000).

Thus one can see how 0='a' is true: it is compared as 0=0.

That password=''='' is true (provided that password is a non-empty string, or a non-zero numeric) comes about because the first comparison results in zero (false), which forces the second comparison to be performed numerically (thus converting '' to zero for comparison with the zero result of the first comparison).

4

Mysql sees the comparison and converts the string to an integer,but this results in an invalid integer so it cast it to 0. 0=0 so its true(1)

0

For SELECT 0='a', 0='';

1. type of 0 is int 
2. type of 'a' is char  then CAST( 'a' AS UNSIGNED ) or CAST( '' AS UNSIGNED ) will be 0

Convert char to int then 0=0 evaluates as true in your case 1. In:

select 'A'='a', 0=0, '0'='a',0='a1';

all columns will be true, but for:

select 0='1a';

will be false because CAST( '1a' AS UNSIGNED ) is 1.

mysql> SELECT 'asadsadsa' = 'a', 0 = 'az', cast( 'az' AS unsigned ) , 'asadsadsa' = 'a' = 'az', 0 =0;
      +-------------------+----------+--------------------------+--------------------------+------+
      | 'asadsadsa' = 'a' | 0 = 'az' | cast( 'az' AS unsigned ) | 'asadsadsa' = 'a' = 'az' | 0 =0 |
      +-------------------+----------+--------------------------+--------------------------+------+
      |                 0 |        1 |                        0 |                        1 |    1 |
      +-------------------+----------+--------------------------+--------------------------+------+
      1 row in set, 3 warnings (0.00 sec)

      Warning (Code 1292): Truncated incorrect DOUBLE value: 'az'
      Warning (Code 1292): Truncated incorrect INTEGER value: 'az'
      Warning (Code 1292): Truncated incorrect DOUBLE value: 'az'
3
  • Why is casting 'a' as an unsigned give you 0? I'm not very familiar with SQL, but shouldn't it give the ASCII value for 'a'?
    – gsgx
    Oct 6, 2013 at 22:55
  • Read more here dev.mysql.com/doc/refman/5.0/en/…
    – Petre Sosa
    Oct 7, 2013 at 5:33
  • Like in Php (int)"a1" =0, and '1a'=1, I used this exemple to show how MySQL converts the string; see comparison between 2 diferent types.
    – Petre Sosa
    Oct 7, 2013 at 8:37

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.