> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/blind-based/boolean-based.md).

# Boolean Based

Boolean-Based SQL Injection is a type of Blind SQL Injection where the application does not display database errors, but its response changes depending on whether a SQL condition evaluates to **TRUE** or **FALSE**.

Instead of relying on error messages or response delays, the attacker observes differences in the application's content, page structure, record count, or behavior to determine whether a condition is true.

This vulnerability occurs when user input is directly incorporated into a SQL query without proper validation or parameterization.

***

### Vulnerable PHP Code Example

```php
<?php

$conn = mysqli_connect("localhost", "root", "password", "shop");

$id = $_GET['id'];

$query = "SELECT * FROM products WHERE id = '$id'";

$result = mysqli_query($conn, $query);

if (mysqli_num_rows($result) > 0) {
    while ($row = mysqli_fetch_assoc($result)) {
        echo $row['name'];
    }
} else {
    echo "Product not found";
}

?>
```

***

### Code Explanation

The application retrieves the `id` parameter from the URL:

```php
$id = $_GET['id'];
```

The value is directly inserted into the SQL query:

```php
$query = "SELECT * FROM products WHERE id = '$id'";
```

Because user input is concatenated into the SQL statement without validation or parameterization, an attacker may be able to manipulate the query.

The application does not display database errors. Instead, it either displays product information or shows a generic message:

```php
echo "Product not found";
```

This difference in behavior becomes the source of information for the attacker.

***

### How to Exploit

1. Identify a parameter that is used in a database query.
2. Determine whether user input affects the SQL statement.
3. Inject conditions that can evaluate to either **TRUE** or **FALSE**.
4. Observe the application's response for each condition.
5. If the page displays normal content, the condition is considered **TRUE**.
6. If the page displays different content, fewer records, or no results, the condition is considered **FALSE**.
7. Repeat the process with different conditions to gradually retrieve information from the database.
8. Use the application's TRUE/FALSE responses to identify information such as the database version, database name, table names, column names, and stored data.

Because the application does not reveal errors or query results directly, information is extracted one condition at a time based on the application's behavior.