The SQL server then might return an error similar to this:

Microsoft OLE DB Provider for ODBC Drivers error

 80040e14 

[Microsoft][ODBC SQL Server Driver][SQL Server]All

queries in an SQL statement containing a UNION

operator must have an equal number of expressions

in their target lists.

This tells the attacker that he must now guess the correct number of

columns for his SQL statement to work.

Blind SQL Injection

In Blind SQL Injection, instead of returning a database error, the

server returns a customer friendly error page informing the user that

a mistake has been made. In this instance, SQL Injection is still

possible, but not as easy to detect. A common way to detect Blind

SQL Injection is to put a false and true statement into the parameter

value.

Executing the following request to a web site:

http://example/article.asp?ID=2+and+1=1

should return the same web page as:

http://example/article.asp?ID=2

because the SQL statement  and 1=1  is always true.

Executing the following request to a web site:

http://example/article.asp?ID=2+and+1=0

38

Copyright 2004, Web Application Security Consortium. All rights reserved.