I don't get how this SQL Query work and the := operator

Question

I found this sql query online , i did work but am not quite able to parse it . i haven't used any queries with '@' or " := " if some one could explain me what it means and which topic it comes under , it would help me a lot ..

 select (select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema>=@) and (@)in (@:=concat(@,0x3C,0x62,0x72,0x3E,' [ ',table_schema,' ] > ',table_name,' > ',column_name))))a)#

See this question: http://stackoverflow.com/questions/1009954/mysql-variable-vs-variable-whats-the-difference. — Patrick Hofman, Dec 08 '14 at 09:13
[:= is the assignment operator](http://dev.mysql.com/doc/refman/5.0/en/assignment-operators.html#operator_assign-value). — John Bupit, Dec 08 '14 at 09:13
can any one explain how @ get assigned ( the order ) and then what the query means ? — Dhayalan Pro, Dec 08 '14 at 09:27
I'd be interested in *where* you found that query online ... — Hartmut Holzgraefe, Dec 08 '14 at 09:37
Perhaps it was some sort of site like this http://www.securityidiots.com/Web-Pentest/SQL-Injection/sql-evil-twin-injection.html — DKSan, Dec 08 '14 at 09:41

score 2 · Answer 1 · answered Dec 08 '14 at 10:41

First of all i would make the query a litte bit more readable by reformatting it:

1) SELECT (SELECT (@)
2)         FROM (SELECT (@:=0x00),
3)                      (SELECT (@)
4)                       FROM (information_schema.columns)
5)                       WHERE (table_schema >= @)
6)                       AND   (@) IN (@:=CONCAT(@,0x3C,0x62,0x72,0x3E,' [ ',table_schema,' ] > ',table_name,' > ',column_name))
7)                       )
8)               )
9)        a);

The assignment of @ is as follows:

In Line 3 it gets the value 0x00 (Decimal: 0)
In line 5 this value is used for the greater than (table_schema >= 0)
Line 6 is a way to concat each schema, table and column name into @
@ is returned in line 1 and contains a concatenated list of your structures

In line 6 an additional <br> (0x3C,0x62,0x72,0x3E) is added to the variable to make the output more readable

I don't get how this SQL Query work and the := operator

1 Answers1