sqlmapproject/sqlmap · error · SqlmapSyntaxException

invalid format of a safe request file

Error message

invalid format of a safe request file

What it means

_setSafeVisit parses the file given via --safe-req as a raw HTTP request (request line, headers, blank line, optional body). If the raw content cannot be interpreted as a valid HTTP request — no valid request line/URL, unparseable headers — the parser bails and this SqlmapSyntaxException is raised; the sentinel guard catches an input file that is not a serialized HTTP request.

Solutions

  1. Capture the file from a real request, e.g. with Burp: right-click > 'Copy to file' > 'items', or save a raw request from the proxy history.
  2. Ensure the file starts with a proper request line like `GET /path HTTP/1.1` followed by `Host:` and other headers, then a blank line, then the body.
  3. Use CRLF (\r\n) line endings as in a real HTTP request; avoid editing the file with tools that mangle the format.
  4. Verify the file is not empty, HTML-pasted, or URL-encoded-only content — it must be a raw request dump.
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at lib/core/option.py:1417 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/956fa1dd5c863a3d. Report an issue: GitHub.

Appendix: source

Thrown at lib/core/option.py:1417

                            value = "%s://%s" % (scheme, value)
                        kb.safeReq.url = _urllib.parse.urljoin(value, kb.safeReq.url)
                else:
                    break

            post = None

            if '\r\n\r\n' in raw:
                post = raw[raw.find('\r\n\r\n') + 4:]
            elif '\n\n' in raw:
                post = raw[raw.find('\n\n') + 2:]

            if post and post.strip():
                kb.safeReq.post = post
            else:
                kb.safeReq.post = None
        else:
            errMsg = "invalid format of a safe request file"
            raise SqlmapSyntaxException(errMsg)
    else:
        if not re.search(r"(?i)\Ahttp[s]*://", conf.safeUrl):
            if ":443/" in conf.safeUrl:
                conf.safeUrl = "https://%s" % conf.safeUrl
            else:
                conf.safeUrl = "http://%s" % conf.safeUrl

    if (conf.safeFreq or 0) <= 0:
        errMsg = "please provide a valid value (>0) for safe frequency ('--safe-freq') while using safe visit features"
        raise SqlmapSyntaxException(errMsg)

def _setPrefixSuffix():
    if conf.prefix is not None and conf.suffix is not None:
        # Create a custom boundary object for user's supplied prefix
        # and suffix
        boundary = AttribDict()

        boundary.level = 1

View on GitHub (pinned to 0a35b20e39)