sqlmapproject/sqlmap · error · RuntimeError

no working substring function found

Error message

no working substring function found

What it means

Error "no working substring function found" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/esperanto/discovery.py:216

            if base is None:
                continue
            self.dialect.substring = Cap(name, tmpl, index_base=base)
            # base detection above CONFIRMS the substring fn works; the property
            # measurements below are best-effort and MUST NOT discard it - a probe the
            # oracle can't decide leaves the property at a safe default, never aborts.
            props = self.dialect.substring.props
            try:
                props["beyond_end"] = self._edgeBehavior(self._sub("'ABCDE'", 6, 1))
                props["zero_length"] = self._edgeBehavior(self._sub("'ABCDE'", 1, 0))
                props["unit"] = self._substringUnit()
            except OracleUndecided:
                pass
            props.setdefault("beyond_end", "unknown")
            props.setdefault("zero_length", "unknown")
            props.setdefault("unit", "unknown")
            return name
        self.dialect.substring = None
        raise RuntimeError("no working substring function found")

    def _codeCharTmpl(self):
        # a code->char template (CHAR/CHR/NCHAR), probed ASCII-only and cached. lets
        # the unicode PROPERTY probes build a multibyte test char server-side instead
        # of pushing a raw non-ASCII byte through the URL/app/DBMS encoding layers.
        if self._codeTmpl is None:
            self._codeTmpl = False
            # PASS 1 prefers a UNICODE-capable constructor (one that yields a non-NULL char for a
            # code point > 255), so SQL Server picks NCHAR over the byte-only CHAR - CHAR(8364)
            # is NULL there and would break the euro/UTF-16 probes. PASS 2 accepts any ASCII-
            # working constructor when no Unicode-capable one exists.
            for unicode_capable in (True, False):
                for _, tmpl in _CHARFROM:
                    if not (self._ask("%s='a'" % tmpl.format(code=97)) and
                            not self._ask("%s='b'" % tmpl.format(code=97))):
                        continue
                    if unicode_capable and not self._ask("(%s) IS NOT NULL" % tmpl.format(code=256)):
                        continue

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/esperanto/discovery.py:216 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/24d6b6e2f62349a8. Report an issue: GitHub.