What is the smallest possible SQL injection attack character sequence?

Question

Simple, a SQL injection attack in as few characters as possible. Note, I'm not trying to prevent SQL injection attacks by limiting inputs to a certain size, but rather am genuinely curious how many characters is needed to execute even the simplest attack.

For posterity sake, let's say the smallest table name is 4 characters, e.g., "user". Please factor that in.

Multiangular

Answer 1

1 Character is the smallest unit that you have control over. The question depends heavily on what you're doing. For instance, if you're dealing with an interface to delete your profile from a site, and you send '%' instead of your name:

"Delete from Users where name like '"+username+"'"

then setting your username to % will delete all the users.

Rachitis

What sane site would use like? – Involuntary

What sane site would allow SQL injection attacks? – Rachitis

None, but what sane site wouldn't sanitize their database inputs? – Kurt

SQL injection is the natural path of a beginner developer. Using like for this isn't. – Involuntary

I think you would be surprised at what people are capable of. Either way, given this contrived example, a single character would be capable of causing havoc. – Rachitis

Good example, it shows how dangerous SQL injection is. However, if you're using ' or 1=1 --, it does not matter if you used like or not in your SQL command, it will always delete all users. – Kirchner

Answer 2

When injecting into a string literal:

';drop database;--

Involuntary

I believe this is the answer I was seeking, as it is a more realistic use case. However, the other answer below, while maybe not realistic, is the shorter answer (and creative). Thanks for your answer. – Multiangular

Answer 3

how about this one:

' OR 1=1 --

Camus

Answer 4

Suppose the query was generated like this

"Select * from user where userid = " + myVar 

1; delete from user;

Thimbleful

Answer 5

To summarize, if I trim my inline variable to have 13 chars max no dangerous sql injection is possible. In my sql 13 chars is enough to match any of my results with charindex. I cannot use parameterized stored procedure since my sql is dynamically generated in C# with complicated if else logic.

Fess