# Substring() function in Exploiting Boolean-based blind SQL injection Part 2

**URL:** <https://legacy-community.ine.com/t/substring-function-in-exploiting-boolean-based-blind-sql-injection-part-2/5703>\
**Category:** Web Application Penetration Testing Professional\
**Tags:** red, cybersec\
**Created:** [June 30, 2024, 2:51am UTC](https://legacy-community.ine.com/t/substring-function-in-exploiting-boolean-based-blind-sql-injection-part-2/5703 "2024-06-30T02:51:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![iSgapetti](https://avatars.discourse-cdn.com/v4/letter/i/c37758/32.png) [@iSgapetti](https://legacy-community.ine.com/u/iSgapetti)\
**Post date:** [June 30, 2024, 2:51am UTC](https://legacy-community.ine.com/t/substring-function-in-exploiting-boolean-based-blind-sql-injection-part-2/5703/1 "2024-06-30T02:51:13Z")

</div>

The instructor is clearly wrong with the use of the `substring()` function of MYSQL.

To try and extract the 6th character of the version, he used `substring(version(),6,6)=6--`

He clearly didn’t even think to research the correct syntax which is `substring("string", start at position n, extract n characters)`