# Comma is forbidden! No worries!! Inject in insert/update queries without it

Comma-split insert-query SQLi bypassed by replacing IF/substring with CASE/like and casting to char, enabling time-based blind data extraction.

- Payout: $10,000
- Severity: high
- Program: -
- Credited: Ahmed Sultan
- Disclosed: 2019-03-31
- Write-up quality: 7/10
- Original: https://blog.redforce.io/sql-injection-in-insert-update-query-without-comma/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-redforce-io-sql-injection-in-insert-update-query-without-comma
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:high tech:rest technique:blind vuln:sqli

**Target:** POST endpoint with urls[]/methods[] params inserted into SQL
**Root cause:** User input concatenated into insert query; app splits input on commas, blocking standard IF/substring payloads but not CASE/like alternatives.
**Steps:**
1. Identify urls[]/methods[] params split by `,` before insertion into `insert into xxxxxx (url,method) values ('$url','method')`
2. Replace IF with `CASE WHEN ... THEN sleep(1) ELSE 2 END` to avoid commas
3. Replace substring with `like 'prefix%'` for char brute-force
4. Wrap in `cast(... as char)` to fix concatenation: `xxx'-cast((select CASE WHEN ((MY_QUERY) like 'CHAR%25') THEN (sleep(1)) ELSE 2 END) as char)-'`
5. Automate length and char extraction via response timing >2s
**How found:** Noticed input split on commas broke standard IF/substring payloads; searched for comma-free SQL equivalents (CASE, like) and cast to char to make concatenation work.
**Exploitation:** Time-based blind extraction: POST urls[] payload with CASE/like condition; sleep(1) on true reveals length then each character of arbitrary subquery output.
**Insight:** When a filter/splitter blocks commas, swap IF(a,b,c) for CASE WHEN a THEN b ELSE c END and substring for LIKE 'prefix%'; cast subquery to char to embed in string context.