python Verified current stable Not installed? Security

Python / Change Parameter Delimiter

Change Parameter Delimiter

Changes parameter delimiter for SQL injection testing.

$
Terminal
python sqlmap.py -u "{http://www.example.com/vuln.php}" --data="<query=foobar;id=1>" --param-del="<;>"

When To Use

When a web application uses non-standard delimiters in query strings.

Pro Tip

Test different delimiters if initial attempts fail; use --data for clarity in payload structure.

Anatomy of Output

Understanding the result

[04:00:15] [INFO] using a custom parameter delimiter: ';' Delimiter Info

Indicates that a non-standard delimiter is being used.

[04:00:16] [EXECUTION] payload: 'foobar; id=1' Final Payload Execution

Shows the resolved payload sent to the server.

[04:00:17] [SUCCESS] injection confirmed: 'foobar' Injection Confirmation

Indicates successful injection using the custom delimiter.

Power User Variants

Optimized versions

python sqlmap.py -u 'http://www.example.com/vuln.php' --data='query=foobar;id=1' --param-del='&'

Switch to a standard ampersand delimiter.

python sqlmap.py -u 'http://www.example.com/vuln.php' --data='query=foobar;id=1' --param-del=':'

Test with a colon as the delimiter.

Troubleshooting

Common pitfalls

sqlmap -u '...' --data '...' --param-del ';' - ERROR: Unsupported delimiter

Solution: Ensure the delimiter is correctly defined and appropriate for the application.

sqlmap -u '...' --data='...' - ERROR: Malformed SQL syntax

Solution: Double-check the data format and query structure; ensure valid payload.

sqlmap -u '...' --data='...' - ERROR: 400 Bad Request

Solution: Review the request structure; it may be invalid for the application.

Command Breakdown

What each part is doing

python
Base Command
The executable that performs this operation. Here it runs Python before the shell applies any redirect operators.
-u
u| url
The URL supplied to this command.
{http://www.example.com/vuln.php}
http: www.example.com vuln.php
The value supplied for http: www.example.com vuln.php.
<query=foobar;id=1>
query=foobar;id=1
The value supplied for query=foobar;id=1.
<;>
;
The value supplied for ;.
-u
Command Option
Tool-specific option used by this command invocation.
--data="<query=foobar;id=1>"
Command Option
Tool-specific option used by this command invocation.
--param-del="<;>"
Command Option
Tool-specific option used by this command invocation.

Alternative Approaches

Comparable commands in other tools

Alternative security tools for the same job.