this will be valid for most database platforms. Where necessary I will highlight platform-specific variations to the standard
The primary role of the SELECT statement is to retrieve data from a database and return it to the application or user. Microsoft SQL server also allows you to use SELECT statements to read table data from one table and insert it into another. You use the UNION operator to combine the result sets of two or more SELECT statements. All SELECT statements within the union must return the same number of columns and their data type must be compatible. To permit duplicates and prevent the database from comparing the returned data, use UNION ALL SELECT
use the INSERT statement to insert data into a table . The most significant problem with this approachis that if the table structure is changed (e.g., columns are added or deleted) data could be written to the wrong column. use the UPDATE statement to modify existing data within a database table. all UPDATE statements should include a WHERE clause to indicate which rows should be updated,or all rows are affected.use the DELETE statement to delete rows from a table. all DELETE statements should include a WHERE clause to indicate which rows should be deleted.
use the DROP statement to delete database objects such as tables, views, indexes, users. use the CREATE TABLE statement to create a new table in the current database or schema.INTEGER or INT - A 32-bit signed integer value. Oracle allows you to create a table and populate it with data from another table or view: use the ORDER BY clause to sort the results of a SELECT statement by a specific column
You can use the ALTER TABLE statement to add, delete, or modify a column within an existing table. use the GROUP BY statement when performing an aggregate function such as SUM against a column in a table .
When performing SQL injection attacks you will often need to limit the number of table rows returned by your injected query (e.g., when extracting data via error messages). The syntax for selecting a specific row from a table varies among database platforms. Table details the SQL syntax for selecting the first and fifth rows from the tblUsers table.
محمد صديق يواصل
the single quote character is often filtered or doubled up as a defense mechanism. this strategy fails when the vulnerable user input is a numeric value, and therefore is not delimited using quote characters.
The DUAL Dummy table (as it is sometimes called) is an automatically-generated table assigned to SYS, but accessible to all users. It is useful because it always exists, and has a single row, which is handy for select statements with constant expressions. You could just as easily do this with any other table with a single row, but using DUAL makes it portable among all Oracle installations.Example: SELECT 1+1 FROM DUAL;1+1----------2
In the following example, we have created a variable named @qand placed the query SELECT ‘ABC’ into it via a HEX-encoded string
by encoding your input using exotic encoding standards or via double encoding.
In the Table lists common SQL metacharacters in a number of encoded formats.