1

For conditional-error-based SQLi, instead of writing 1/0 directly like MYSQL, we need to write to_char(1/0) for Oracle, what is the reason behind this? Example,

Oracle:

SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN TO_CHAR(1/0) ELSE NULL END FROM dual

Microsoft:

SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN 1/0 ELSE NULL END

Reference: https://portswigger.net/web-security/sql-injection/cheat-sheet#conditional-errors

Improve this question
5
  • what happens if you do omit the to_char function?
    – miracle173
    Commented Jan 23, 2023 at 11:04
  • If I remove to_char I get an error irrespective of the condition.
    – Vbr
    Commented Jan 23, 2023 at 17:45
  • No, that is not true. You get an error if the condition is true and you get not error if the condition is wrong
    – miracle173
    Commented Jan 24, 2023 at 9:38
  • How does the answer accepted by you explain why a conversion to character is used in case of Oracle but not in case of Microsoft?
    – miracle173
    Commented Jan 24, 2023 at 9:53
  • You're right, Microsoft's documentation for CASE also suggests the same thing as Oracle. I ran the commands on oracle database and it is not giving an error there. However, it does give an error on actual target machines when trying to inject it as sqli payload. Any other reason why it needs the to_char?
    – Vbr
    Commented Jan 24, 2023 at 16:36

1 Answer 1

Reset to default
0

The first possible result of the case when expression determines the output type. All potential results must conform to the same output type. You would use to_char or cast to tell Oracle that the remaining options are also varchar2

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.