DB.
Courses

Bypassing Character Restrictions
OSWE · Chapter 16

Bypassing Character Restrictions

Bypassing character restrictions covers the general skill of working around input filters that block specific characters (quotes, spaces, slashes) rather than validating the whole input structure — a recurring theme across SQLi, XSS, and command injection.

Key concepts

  • If quotes are blocked but not hex/char encoding, many SQL dialects let you express string literals without a single quote character at all.
  • If spaces are blocked in command injection contexts, alternatives like `${IFS}`, tabs, or `<` for redirection-based spacing often still work.
  • Encoding transformations (URL-encoding, double-encoding, Unicode normalization) are the most common way filtered characters slip through as something else entirely by the time they reach the vulnerable sink.
  • The lesson generalizes: blocklisting individual characters is fragile. Robust defenses validate against an allow-list of expected structure, not against a list of "bad" characters.

Example

-- Bypassing a blocked single-quote in some SQL dialects via hex literal
SELECT * FROM users WHERE name = 0x61646d696e -- hex for 'admin', no quote character used

Try it yourself

On a lab SQLi challenge that blocks single quotes, try rewriting your payload using a hex-encoded string literal instead, and confirm whether the filter still blocks it.

ReferenceSearch video walkthroughs

@ Daniel Burlacu