(expression)
return expression
If the user provided an asterisk rather than the column(s)
    name, sqlmap will retrieve the columns itself and reprocess
    the SQL query string (expression)
If the user provided an asterisk rather than the column(s)
    name, sqlmap will retrieve the columns itself and reprocess
    the SQL query string (expression)
If the user provided an asterisk rather than the column ( s ) name sqlmap will retrieve the columns itself and reprocess the SQL query string ( expression )
def expandAsteriskForColumns(expression):
    """
    If the user provided an asterisk rather than the column(s)
    name, sqlmap will retrieve the columns itself and reprocess
    the SQL query string (expression)
    """

    asterisk = re.search("^SELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+`?([^`\s()]+)", expression, re.I)

    if asterisk:
        infoMsg = "you did not provide the fields in your query. "
        infoMsg += "sqlmap will retrieve the column names itself"
        logger.info(infoMsg)

        _ = asterisk.group(2).replace("..", ".").replace(".dbo.", ".")
        db, conf.tbl = _.split(".", 1) if '.' in _ else (None, _)
        if db is None:
            if expression != conf.query:
                conf.db = db
            else:
                expression = re.sub(r"([^\w])%s" % re.escape(conf.tbl), "\g<1>%s.%s" % (conf.db, conf.tbl), expression)
        else:
            conf.db = db
        conf.db = safeSQLIdentificatorNaming(conf.db)
        conf.tbl = safeSQLIdentificatorNaming(conf.tbl, True)

        columnsDict = conf.dbmsHandler.getColumns(onlyColNames=True)

        if columnsDict and conf.db in columnsDict and conf.tbl in columnsDict[conf.db]:
            columns = columnsDict[conf.db][conf.tbl].keys()
            columns.sort()
            columnsStr = ", ".join(column for column in columns)
            expression = expression.replace("*", columnsStr, 1)

            infoMsg = "the query with expanded column name(s) is: "
            infoMsg += "%s" % expression
            logger.info(infoMsg)

    return expression
def expandAsteriskForColumns ( expression ) : asterisk = re . search ( "^SELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+`?([^`\s()]+)" , expression , re . I ) if asterisk : infoMsg = "you did not provide the fields in your query. " infoMsg += "sqlmap will retrieve the column names itself" logger . info ( infoMsg ) _ = asterisk . group ( 2 ) . replace ( ".." , "." ) . replace ( ".dbo." , "." ) db , conf . tbl = _ . split ( "." , 1 ) if '.' in _ else ( None , _ ) if db is None : if expression != conf . query : conf . db = db else : expression = re . sub ( r"([^\w])%s" % re . escape ( conf . tbl ) , "\g<1>%s.%s" % ( conf . db , conf . tbl ) , expression ) else : conf . db = db conf . db = safeSQLIdentificatorNaming ( conf . db ) conf . tbl = safeSQLIdentificatorNaming ( conf . tbl , True ) columnsDict = conf . dbmsHandler . getColumns ( onlyColNames = True ) if columnsDict and conf . db in columnsDict and conf . tbl in columnsDict [ conf . db ] : columns = columnsDict [ conf . db ] [ conf . tbl ] . keys ( ) columns . sort ( ) columnsStr = ", " . join ( column for column in columns ) expression = expression . replace ( "*" , columnsStr , 1 ) infoMsg = "the query with expanded column name(s) is: " infoMsg += "%s" % expression logger . info ( infoMsg ) return expression