diff --git a/tamper/between.py b/tamper/between.py index 136fbadf3..6035c4c0d 100644 --- a/tamper/between.py +++ b/tamper/between.py @@ -38,29 +38,10 @@ def tamper(payload, **kwargs): retVal = payload if payload: - retVal = "" - quote, doublequote, firstspace = False, False, False + match = re.search(r"(?i)(\b(AND|OR)\b\s+)(?!.*\b(AND|OR)\b)([^>]+?)\s*>\s*([^>]+)\s*\Z", payload) - for i in xrange(len(payload)): - if not firstspace: - if payload[i].isspace(): - firstspace = True - retVal += " " - continue - - elif payload[i] == '\'': - quote = not quote - - elif payload[i] == '"': - doublequote = not doublequote - - elif payload[i] == ">" and not doublequote and not quote: - retVal += " " if i > 0 and not payload[i - 1].isspace() else "" - retVal += "NOT BETWEEN %s AND" % ('0' if re.search(r"\A[^\w]*\d", payload[i + 1:]) else "NULL") - retVal += " " if i < len(payload) - 1 and not payload[i + 1:i + 2].isspace() else "" - - continue - - retVal += payload[i] + if match: + _ = "%s %s NOT BETWEEN 0 AND %s" % (match.group(2), match.group(4), match.group(5)) + retVal = retVal.replace(match.group(0), _) return retVal