# Filter Evasion

Nowadays web apps have deployed security measures to block conventional and normal SQL payloads to protect themselves hence there is a need to use more sophisticated techniques to bypass filters in place and penetrate the systems.

## Character Encoding

* URL Encoding: Can be seen frequently in GET requests. Here characters are replaced by % followed by ASCII values in hex.&#x20;
* Hexadecimal Encoding:&#x20;
* Unicode Encoding: Unicode escape sequences are used.

## No Quote SQLi

The trick here is to use other data types or numbers that don't need quotes. For example `' OR '1'='1` can be used as `or 1=1`&#x20;

* Use `CONCAT()`: The function can be used to construct strings without quotes. For example `CONCAT(0x4b, 0x61, 0x76, 0x69, 0x6e)` builds the string `Kavin`.&#x20;

## No Spaces

Here spaces are replaced by SQL Comments `/**/` . This is to bypass filters that block spaces. For example: \
`SELECT * FROM users;`  gets converted to `SELECT/**/*/**/FROM/**/users;`&#x20;

Tab or newline characters i.e `\t` or `\n` can also be used instead of spaces.

Characters like `%0A`, `%09` , `%0C` , `%0D` or `%A0` can also be used.&#x20;

For example: `1'%250A||%250A1=1- -` is the URL encoded payload for `1'%0A||%0A1=1- -` . Here special characters are used to bypass the no space filters too.&#x20;

## Important !

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2F90ZjjqXkZVv2uGZU2O49%2Fimage.png?alt=media&#x26;token=7b8762c1-082d-4e0f-b49e-83cd081da63d" alt=""><figcaption></figcaption></figure>

No one technique guarantees bypassing any filters or layers of protection hence the key is to use have knowledge on multiple approaches and try everything till something works. Above are some miscellaneous ways to evade filters.&#x20;
