Meaning of these two queries (sql injection) - sql

Can someone explain why these two queries (sometimes) do cause errors? I googled some explanations but none of them were right. I dont want to fix it. This queries should be actually used for SQL injection attack (I think error based sql injection). Triggered error should be "duplicate entry". I'm trying to found out why are they sometimes counsing errors.
Thanks.
select
count(*)
from
information_schema.tables
group by
concat(version(),
floor(rand()*2));
select
count(*),
concat(version(),
floor(rand()*2))x
from
information_schema.tables
group by
x;


It seems the second one is trying to guess which database the victim of the injection is using.
The second one is giving me this:
+----------+------------------+
| count(*) | x |
+----------+------------------+
| 88 | 10.1.38-MariaDB0 |
| 90 | 10.1.38-MariaDB1 |
+----------+------------------+


Okay, I'm going to post an answer - and it's more of a frame challenge to the question itself.
Basically: this query is silly, and it should be written; find out what it's supposed to do and rewrite it in a way that makes sense.
What does the query currently do?
It looks like it's getting a count of the tables in the current database... except it's grouping by a calculated column. And that column looks like it is Version() and appends either a '0' or a '1' to it (chosen randomly.)
So the end result? Two rows, each with a numerical value, the sum of which adds up to the total number of tables in the current database. If there are 30 tables, you might get 13/17 one time, 19/11 the next, followed by 16/14.
I have a hard time believing that this is what the query is supposed to do. So instead of just trying to fix the "error" - dig in and figure out what piece of data it should be returning - and then rewrite the proc to do it.

Related

MS Access SQL receiving no results when joining tables in where clause

i am trying to update a colleague's MS Access application (with vb-code). I am rather experienced in writing SQL queries but i am not able to solve the following problem.
The query i am looking to fix uses a pass-through-query's result and a local MS Access table and joins them togehter in the where-clause (i tried using the normal way with ON but it seems this doesn't work when there is a pass through query involved). I have little experience with joining tables in the where-clause but is there such a thing that i cant use certain columns (of both tables) in the where-clause when joining tables in the where-clause? -> When i use a filter criteria such as columnA <> 'somerandomtext' (which is always satisfied, just to point out the problem) the query result is empty. When i delete the latter criteria in the where clause, the query returns results (although too many because i cant filter them accordingly).
Furthermore: I checked the pass-through-query, the results are correct. I checked the MS-Access table, the data in the table is correct. Therefore, i think i might be doing something wrong in the query where i join the two mentioned above.
THIS QUERY WORKS AS INTENDED AND RETURNS RESULTS:
SELECT t.tr_id, t.ser_num, t.contrgnt_id, t.pos_ekey, t.sernum AS cmdty, format(t.vol,""##,###,###.00"") AS volume, t.unit_def, t.value_date,
format(t.coup,""##,###,###.00"") AS fixprice,
format(s.calcvarprice,""##,###,###.00"") AS marketprice,
format(s.calcamount,""##,###,###.00"") AS payamount,
format(s.settlevarprice, ""##,###,##0.00"") as settleprice,
format(s.settleamount, ""##,###,##0.00"") as settleamount, s.sync
FROM pms_trans AS t, settledata AS s
WHERE t.tr_id=s.tr_id And t.is_booked='N' And t.value_date>='01.01.2021' And t.value_date<='01.04.2021'
THIS QUERY SOMEHOW RETURNS 0 RESULTS:
SELECT t.tr_id, t.ser_num, t.contrgnt_id, t.pos_ekey, t.sernum AS cmdty, format(t.vol,""##,###,###.00"") AS volume, t.unit_def, t.value_date,
format(t.coup,""##,###,###.00"") AS fixprice,
format(s.calcvarprice,""##,###,###.00"") AS marketprice,
format(s.calcamount,""##,###,###.00"") AS payamount,
format(s.settlevarprice, ""##,###,##0.00"") as settleprice,
format(s.settleamount, ""##,###,##0.00"") as settleamount, s.sync
FROM pms_trans AS t, settledata AS s
WHERE t.tr_id=s.tr_id And t.is_booked='N' And t.pos_ekey <> 'BGGS' And t.value_date>='01.01.2021' And t.value_date<='01.04.2021'
As mentioned before, i suspect that there are some limitations when joining via where-clause (although i didnt find sufficient information online).
Best Regards and thank you in advance,
Peter

First, apply the correct syntax for the date expressions:
WHERE t.tr_id=s.tr_id And t.is_booked='N' And t.pos_ekey <> 'BGGS' And t.value_date >= #2021-01-01# And t.value_date <= #2021-04-01#
Next, double-check the values for pos_ekey. For example, try to apply the filter, <> 'BGGS', directly on the field in table view.

Redshift SQL WHERE statement doesn't seem to filter correctly?

So I have a pretty simple query something like:
Select * from TableX where column1 = '2020-24'
However, in the results we get column 1 but it is not restricted to 2020-24 (week 24 in 2020), I see 2020-20 and 2020-05 etc.
I assume it's something to do with text/number formatting or something. I am using Redshift SQL, how can I fix this so it only shows rows where column 1 is '2020-24'? I tried use the WHERE with 2020-24 and with '2020-24' but both give the same result. I have heard I may need to cast with :: notation but not sure how..

Order by in subquery behaving differently than native sql query?

So I am honestly a little puzzled by this!
I have a query that returns a set of transactions that contain both repair costs and an odometer reading at the time of repair on the master level. To get an accurate Cost per mile reading I need to do a subquery to get both the first meter reading between a starting date and an end date, and an ending meter.
(select top 1 wf2.ro_num
from wotrans wotr2
left join wofile wf2
on wotr2.rop_ro_num = wf2.ro_num
and wotr2.rop_fac = wf2.ro_fac
where wotr.rop_veh_num = wotr2.rop_veh_num
and wotr.rop_veh_facility = wotr2.rop_veh_facility
AND ((#sdate = '01/01/1900 00:00:00' and wotr2.rop_tran_date = 0)
OR ([dbo].[udf_RTA_ConvertDateInt](#sdate) <= wotr2.rop_tran_date
AND [dbo].[udf_RTA_ConvertDateInt](#edate) >= wotr2.rop_tran_date))
order by wotr2.rop_tran_date asc) as highMeter
The reason I have the tables aliased as xx2 is because those tables are also used in the main query, and I don't want these to interact with each other except to pull the correct vehicle number and facility.
Basically when I run the main query it returns a value that is not correct; it returns the one that is second(keep in mind that the first and second have the same date.) But when I take the subquery and just copy and paste it into it's own query and run it, it returns the correct value.
I do have a work around for this, but I am just curious as to why this happening. I have searched quite a bit and found not much(other than the fact that people don't like order bys in subqueries). Talking to one of my friends that also does quite a bit of SQL scripting, it looks to us as if the subquery is ordering differently than the subquery by itsself when you have multiple values that are the same for the order by(i.e. 10 dates of 08/05/2016).
Any ideas would be helpful!
Like I said I have a work around that works in this one case, but don't know yet if it will work on a larger dataset.
Let me know if you want more code.

sql query to show a range and account for missing numbers

I have a SQL query
SELECT
Group_Id, MIN(Rec_Number) as RecStart, MAX(Rec_Number) AS RecEnd
FROM
Rec
WHERE
Group_Id != ''
GROUP BY
Group_Id
ORDER BY
Group_Id
This produces the following kind of results.
92-2274 9222740001 9222740004
92-2275 9222750001 9222750026
etc...
However if record 3 is missing (in the first row for instance) the query obviously doesn't account for it. What I am trying to do is the following
92-2274 9222740001 9222740002
92-2274 9222740004 9222740018
92-2275 9222750001 9222750016
92-2275 9222750018 9222750026
etc...
So essentially each time the script sees a record missing inside the group it starts a new line whilst staying inside the group before iterating on the next group. The group_Id is of course the first 6 digits of the rec_Number
I would also like to do this as well
92-2274 0001 0002
92-2274 0003 0004
Or even trim it to and remove the leading 0's as well if possible I know about using Right (Rec_Number, 4) however as this is a float the automatic convert to string seems to be messing something up as I get +009 is many columns so I assume I need to cast first or something. This particular function I could do it Excel after the fact I guess but I'm sure SQL could do it if the guy writing the query was a DBA and not a bumbling server admin (that's me!)
So is there a way of doing that in SQL also I must warn you that the standard CTE or using functions such as row number don't work as this is SQL Server 2000 - yes it is that old!
Hence me struggling to find posts on Stack Overflow that apply. Many of them start with the WITH keyword which means I can't use any of those to start with!
I think I am needing an IF ELse kind of block but I am not sure what kind of method I can use to get the query to create a new row each time it hits a missing concurrent number in the group range.
The final output will show me the ranges of records in each group whilst highlighting the missing ones via a new line each time.

For the second part, this should work :
RIGHT ( CAST ( MIN (Rec_Number) as Decimal(10)), 4)
It will only keep the last 4 characters of your number.

SQL query exlude data between date and also matching another condition

All,
First time poster on here. I am trying to create a query where I want to exclude data between a date range but also having certain codes.
Date:
(substring(CAST(UTCBigintToUTCTime(starttime) as varchar(19)),0,11) not between '2012-05-08%' and '2012-05-10%
Status Code:
statuscode NOT IN ('58','59'))
What would my statement look like to exclude data that meets BOTH of those conditions? Everything I do excludes all in that date range and all in the status code range.
Thanks in advance. SQL newbie but learning :).

It seems to me that you're over-thinking it a bit, and making it more complex than it needs to be.
And making it this complex, especially with negative logic, will also make it perform poorly.
How about something like:
select * from myTable where starttime < '2012-05-08' and starttime > '2012-05-10' and statuscode < 58 and statuscode > 59
Not sure what database you are using, or exactly what your data types are - adjust slightly as necessary, but try to stay away from nasty date/string conversions and 'NOT' conditions wherever possible.

try this
select * from myTable where convert(date,starttime) not between '2012-05-08' and '2012-05-10' and statuscode not in (58,59)
and let me know.