Search code examples
sqlsql-servert-sqlsql-injection

Is there a way to remove spaces from T-SQL commands and still execute them?

I am trying to execute a command but I need the spaces removed.

Here's the command I want to execute, but it has two spaces:

DROP TABLE Table_1

What I want to do is to convert it to a form which has no spaces. I thought I could use concatenation and the CHAR string function to produce a string to execute:

'DROP'+CHAR(32)+'TABLE'+CHAR(32)+'Table_1'

I tried this and passing it to EXEC but this is apparently not valid:

';EXEC('DROP'+CHAR(32)+'TABLE'+CHAR(32)+'Table_1');--

I then considered constructing the string over many lines @declaring temporary variables, but for that it seems I would again need spaces.
Is there a way of doing this?

Solution

  • You can use empty multiline comments instead of whitespace:

    DROP/**/TABLE/**/Table_1

    and it will work fine.