SQL injection lets an attacker change a database query by supplying crafted input. There are three common techniques: union-based, error-based and blind SQL injection. This article covers the error-based technique.

How it works

A common first test for SQL injection is to add a single quote (') to a parameter. If the server returns a database error, the input is reaching the query unescaped.

In error-based SQL injection, the attacker goes one step further: they craft input that makes the database include data, such as its version or a table name, inside the error message. The application does not display query results, but it displays the error, and the error carries the data.

See it in action

The video first shows a normal SQL injection and then the error-based technique.

Example payload used in the demonstration, which makes the database reveal its version in an error:

username=gfh'+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1-- -

Prevention

• Use parameterised queries (prepared statements) for every database call. They keep user input separate from the SQL command, which prevents SQL injection.
• Do not build queries by joining strings with user input, and do not rely on removing or escaping quotes: that approach is easy to bypass.
• Validate input types, for example by requiring numeric IDs to be numbers.
• Show generic error pages in production and log the details on the server. Hiding errors does not fix the vulnerability, but it removes the easiest way to exploit it.
• Run the application with a database account that has only the permissions it needs.

How Vooki Pro helps

• Tests every parameter for classic, error-based and blind SQL injection.
• Flags database error strings and stack traces in responses.
• Shows the payload, the injected parameter and the database error as evidence.
• Retest the finding after the fix to confirm it is closed.

Frequently asked questions

What is error-based SQL injection?

A SQL injection where the database error message itself reveals data or confirms the injection.

Is hiding errors enough to stop SQL injection?

No. Hiding errors makes exploitation harder (it becomes blind SQL injection), but only parameterised queries fix the root cause.

Related: Blind SQL injection: how it works and how to stop it · Turn off debug mode and verbose errors in production