sqlmapproject/sqlmap · error · SqlmapSyntaxException

value for option '--alert' must be valid operating system…

Error message

value for option '--alert' must be valid operating system command(s)

What it means

Startup value-validation guard in _basicOptionValidation: the command from --alert (conf.alert) is executed in a shell after a finding; if it starts with '-' the check startswith('-') assumes it is not a valid command (likely a misplaced flag). The error fires to catch options accidentally parsed as the --alert value.

Solutions

  1. Provide a real OS command, e.g. --alert='ls -la' (quote it so the flag-like text is part of the command)
  2. Check argument ordering/quoting so a following option is not swallowed by --alert
  3. Remove --alert if no notification command is needed
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at lib/core/option.py:3079 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/527b1b6aac094ecf. Report an issue: GitHub.

Appendix: source

Thrown at lib/core/option.py:3079

            errMsg = "option '--skip' is incompatible with option '-p'"
            raise SqlmapSyntaxException(errMsg)

    if conf.rParam and conf.testParameter:
        if intersect(conf.rParam, conf.testParameter):
            errMsg = "option '--randomize' is incompatible with option '-p'"
            raise SqlmapSyntaxException(errMsg)

    if conf.mobile and conf.agent:
        errMsg = "switch '--mobile' is incompatible with option '--user-agent'"
        raise SqlmapSyntaxException(errMsg)

    if conf.proxy and conf.ignoreProxy:
        errMsg = "option '--proxy' is incompatible with switch '--ignore-proxy'"
        raise SqlmapSyntaxException(errMsg)

    if conf.alert and conf.alert.startswith('-'):
        errMsg = "value for option '--alert' must be valid operating system command(s)"
        raise SqlmapSyntaxException(errMsg)

    if conf.timeSec < 1:
        errMsg = "value for option '--time-sec' must be a positive integer"
        raise SqlmapSyntaxException(errMsg)

    if conf.hashFile and any((conf.direct, conf.url, conf.logFile, conf.bulkFile, conf.googleDork, conf.configFile, conf.requestFile, conf.updateAll, conf.smokeTest, conf.wizard, conf.dependencies, conf.purge, conf.listTampers)):
        errMsg = "option '--crack' should be used as a standalone"
        raise SqlmapSyntaxException(errMsg)

    if isinstance(conf.uCols, six.string_types):
        if not conf.uCols.isdigit() and ("-" not in conf.uCols or len(conf.uCols.split("-")) != 2):
            errMsg = "value for option '--union-cols' must be a range with hyphon "
            errMsg += "(e.g. 1-10) or integer value (e.g. 5)"
            raise SqlmapSyntaxException(errMsg)

    if conf.dbmsCred and ':' not in conf.dbmsCred:
        errMsg = "value for option '--dbms-cred' must be in "
        errMsg += "format <username>:<password> (e.g. \"root:pass\")"

View on GitHub (pinned to 0a35b20e39)