Backend

SQL Injection Is Just Four Math Tricks

By 大侠在此在在此 · Jul 31, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Payloads rot when databases, frameworks, or WAFs change. The four mathematical primitives behind every injection technique do not. Understanding them replaces rote memorization with on-the-spot derivation, which is the difference between copying a script and actually owning the attack surface.

Summary

Most SQL injection tutorials teach payloads as recipes to memorize. The underlying logic is simpler: every technique exploits a side channel. OR True short-circuits authentication. AND False turns the server into a truth-table display. UNION SELECT projects stolen data into visible page columns. AND + SUBSTRING weaponizes that truth display to brute-force characters one by one.

When the page shows no data and no true/false difference, the same logic shifts channels. Error-based injection stuffs target data into deliberately triggered exception messages. Time-based injection maps Boolean conditions onto SLEEP() calls, using response latency as a signal. Both are the same predicate-logic core wearing different output masks.

A three-question decision tree replaces payload memorization: what feedback does the page give, how do you route query results into that feedback, and how much data can the channel carry. The math — set theory, predicate logic, type conflicts, conditional delay — stays constant across databases and WAF rules.

Takeaways

— OR True bypasses login by short-circuiting the WHERE clause so the password check never executes.

— AND False probes for injection by turning the page into a Boolean oracle: normal means true, blank or error means false.

— UNION SELECT requires matching the original query's column count, found via ORDER BY probing, then uses placeholder integers to locate visible output slots.

— AND + SUBSTRING weaponizes the Boolean oracle to extract data character by character, with ASCII binary search cutting guesses to about 7 per character.

— Error-based injection uses functions like updatexml() to deliberately trigger type errors that leak target data inside the error message.

— Time-based injection maps Boolean conditions onto IF+SLEEP(), measuring response latency to infer data when no other channel exists.

— All injection techniques are the same operation: route a query result into an observable side channel — result set, truth value, exception, or time.

— The decision flow is always: identify the available feedback channel, then construct a payload that projects data into it, limited by the channel's capacity.

Conclusions

Framing SQL injection as side-channel exploitation unifies techniques that tutorials usually teach as separate recipes. The channel changes; the predicate-logic core does not.

The ORDER BY column-counting trick is a pure set-theory constraint: UNION demands equal columns on both sides, so the attacker reverse-engineers the schema before injecting.

Error-based and time-based injections are mathematically simpler than UNION because they skip column-count matching and output-slot hunting — they just need one function that leaks.

Binary search over ASCII codes turns a 26-try alphabet brute-force into a 7-try logarithmic attack per character, which is the difference between a practical exploit and a timeout.

WAF evasion becomes easier when you treat the payload as a mapping problem: if one function is blocked, substitute another that maps the same Boolean condition onto the same channel.

Concepts & terms

Side channel (in SQL injection)

An observable physical property — page content, HTTP status, error messages, or response time — through which an attacker can infer database query results that are not directly displayed.

Boolean blind injection

A technique that extracts data by appending true/false conditions to a query and observing whether the page renders normally (true) or breaks (false), effectively using the server as a truth-table oracle.

UNION SELECT injection

An attack that uses SQL's UNION operator to append an attacker-controlled result set to the original query's output, requiring the attacker to first determine the number and data types of the original query's columns.

Error-based injection

A technique that deliberately triggers database errors (e.g., via updatexml() or extractvalue() in MySQL) and reads the target data from the error message text returned by the server.

Time-based blind injection

An attack that uses conditional delay functions (IF + SLEEP in MySQL, pg_sleep in PostgreSQL) to encode Boolean query results as measurable differences in server response time.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗