(self, expression, prefix=None, where=None, clause=None)
return query
This method defines how the input expression has to be escaped
        to perform the injection depending on the injection type
        identified as valid
This method defines how the input expression has to be escaped
        to perform the injection depending on the injection type
        identified as valid
This method defines how the input expression has to be escaped to perform the injection depending on the injection type identified as valid
def prefixQuery(self, expression, prefix=None, where=None, clause=None):
        """
        This method defines how the input expression has to be escaped
        to perform the injection depending on the injection type
        identified as valid
        """

        if conf.direct:
            return self.payloadDirect(expression)

        if expression is None:
            return None

        expression = self.cleanupPayload(expression)
        expression = unescaper.escape(expression)
        query = None

        if where is None and kb.technique and kb.technique in kb.injection.data:
            where = kb.injection.data[kb.technique].where

        # If we are replacing (<where>) the parameter original value with
        # our payload do not prepend with the prefix
        if where == PAYLOAD.WHERE.REPLACE and not conf.prefix:
            query = ""

        # If the technique is stacked queries (<stype>) do not put a space
        # after the prefix or it is in GROUP BY / ORDER BY (<clause>)
        elif kb.technique == PAYLOAD.TECHNIQUE.STACKED:
            query = kb.injection.prefix
        elif kb.injection.clause == [2, 3] or kb.injection.clause == [2] or kb.injection.clause == [3]:
            query = kb.injection.prefix
        elif clause == [2, 3] or clause == [2] or clause == [3]:
            query = prefix

        # In any other case prepend with the full prefix
        else:
            query = kb.injection.prefix or prefix or ""

            if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('):
                query += " "

        query = "%s%s" % ((query or "").replace('\\', BOUNDARY_BACKSLASH_MARKER), expression)

        return query
def prefixQuery ( self , expression , prefix = None , where = None , clause = None ) : if conf . direct : return self . payloadDirect ( expression ) if expression is None : return None expression = self . cleanupPayload ( expression ) expression = unescaper . escape ( expression ) query = None if where is None and kb . technique and kb . technique in kb . injection . data : where = kb . injection . data [ kb . technique ] . where # If we are replacing (<where>) the parameter original value with # our payload do not prepend with the prefix if where == PAYLOAD . WHERE . REPLACE and not conf . prefix : query = "" # If the technique is stacked queries (<stype>) do not put a space # after the prefix or it is in GROUP BY / ORDER BY (<clause>) elif kb . technique == PAYLOAD . TECHNIQUE . STACKED : query = kb . injection . prefix elif kb . injection . clause == [ 2 , 3 ] or kb . injection . clause == [ 2 ] or kb . injection . clause == [ 3 ] : query = kb . injection . prefix elif clause == [ 2 , 3 ] or clause == [ 2 ] or clause == [ 3 ] : query = prefix # In any other case prepend with the full prefix else : query = kb . injection . prefix or prefix or "" if not ( expression and expression [ 0 ] == ';' ) and not ( query and query [ - 1 ] in ( '(' , ')' ) and expression and expression [ 0 ] in ( '(' , ')' ) ) and not ( query and query [ - 1 ] == '(' ) : query += " " query = "%s%s" % ( ( query or "" ) . replace ( '\\' , BOUNDARY_BACKSLASH_MARKER ) , expression ) return query