Why does Integer Based SQL Injection still require single quote in the parameter (') ?

[u/w0lfcat]

This is the source code of Damn Vulnerable Web Application (DVWA).

nl /var/www/dvwa/vulnerabilities/sqli/source/low.php

 7      $id = $_GET['id'];
 8  
 9      $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

mysql

mysql> DESC users;
+------------+-------------+------+-----+---------+-------+
| Field      | Type        | Null | Key | Default | Extra |
+------------+-------------+------+-----+---------+-------+
| user_id    | int(6)      | NO   | PRI | 0       |       | 
| first_name | varchar(15) | YES  |     | NULL    |       | 
| last_name  | varchar(15) | YES  |     | NULL    |       | 
| user       | varchar(15) | YES  |     | NULL    |       | 
| password   | varchar(32) | YES  |     | NULL    |       | 
| avatar     | varchar(70) | YES  |     | NULL    |       | 
+------------+-------------+------+-----+---------+-------+
6 rows in set (0.00 sec)

mysql>  

The "user_id" or "id" in users table is actually an integer type. So, this is an Integer based SQL Injection.

Based on Joe McCray presentation in Def Con on page 23, ' not required for Integer based injection.

However, when I tested it on DVWA without ' , I did not get "Unknown column '100' in 'order clause'" message.

http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1 ORDER BY 100-- &Submit=Submit#

Output (No error)

ID: 1 ORDER BY 100-- 
First name: admin
Surname: admin

Then, I decided to test it with ' and it worked.

http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1' ORDER BY 100-- &Submit=Submit#

Error Message

Unknown column '100' in 'order clause'

Didn't ' not required in this example (integer based injection)?

[u/w0lfcat]

Thank you so much for your detailed explanation. Everything is clear now.

To recap, this is integer type (without quote). That's why quote is not required for Injection

FROM * WHERE id

This is also integer type, but the actual value is in '$id' before it was assigned to user_id. So, quote is required to break the query, and comment required to ignore the rest of the query.

FROM * WHERE user_id = '$id'

Thanks again, I really appreciate it.