Search code examples
sqlsecuritysql-injection

What is it CHAR(107)+CHAR(113) in query of SQLi and how to known full list of those chars?

In sql injection we have a query

UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+CHAR(110)+CHAR(106)+CHAR(99)+CHAR(73)+CHAR(66)+CHAR(109)+CHAR(119)+CHAR(81)+CHAR(108)+CHAR(88)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113),NULL--

where are this CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106). Every CHAR is representing a 1 letter, right? Where to see full list of this letters to CHAR?

Solution

  • You can get a table of the ASCII character set with the command man ascii at a terminal prompt on Linux or MacOS (provided man pages are installed).

    Here's a couple of online versions of that table:

    Probably this information is also available on Windows, I don't know.