How do Buffer Overflow SQL Injection occurs?
<p>I have encountered many Sites in my Penetration Testing career in which the Site have Strict WAF, but sometimes can be bypassed by the Logic of Buffer Overflow . For example, consider a Query</p>

<p><code>http://example.com/something.php?id=-1 UNION SELECT 1,2,3,4,5,6--+</code> 
Consider the Vulnerable columns are till 7 . So now, this should print a Vulnerable column number as Output but it gets Error .</p>

<p>Now,</p>

<p><code>http://example.com/something.php?id=-1 UNION%23AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%0aselect 1,2,3,4,5,6--+</code></p>

<p>This actually Prints out the Real column number, which means it has been Bypassed. I know %23= # and %0A  = Space. But i do not understand how this acts behind the scenes. Which i mean Backend Logic. </p>

<p>Can anyone give me a Example of SQL Structure which can cause such type of Buffer Overflow, considering the Backend is MYSQL in terms of Backend Structure (Datatypes) and $query too ..</p>

<p>Help would be appreciated</p>