--- title: Snowflake SQL Injection via Compile-Time Constant... description: A security researcher discovered a novel SQL injection extraction technique against Snowflake backends where standard error-based payloads were silently... canonical: https://daily.dev/posts/snowflake-sql-injection-via-compile-time-constant-folding-with-system-wait-j7j8enpzx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT | daily.dev og:description: A security researcher discovered a novel SQL injection extraction technique against Snowflake backends where standard error-based payloads were silently... og:url: https://daily.dev/posts/snowflake-sql-injection-via-compile-time-constant-folding-with-system-wait-j7j8enpzx og:image: https://api.daily.dev/og/posts/j7J8eNpzX.png og:image:alt: Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 9 min read · 0 upvotes · 0 comments ## Summary A security researcher discovered a novel SQL injection extraction technique against Snowflake backends where standard error-based payloads were silently swallowed. The key insight: Snowflake processes queries in three phases (parsing, compilation, execution), and the vulnerable application only suppressed execution-phase errors while returning compilation errors verbatim. By exploiting Snowflake's compile-time constant folding behavior with SYSTEM$WAIT — which requires a constant numeric argument — the researcher forced the compiler to evaluate session functions like CURRENT_DATABASE() and CURRENT_USER() during compilation, embedding their values in the resulting compilation error message. This bypassed the application's error suppression entirely. The technique is bounded to session metadata (not table data), but still yields meaningful reconnaissance from an injection point that initially appeared unreadable. Mitigations include parameterized queries, input validation, suppressing all database errors from client responses, and query tagging for audit trails. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal](https://daily.dev/posts/from-bug-to-schema-exploring-error-based-sql-injection-on-an-authenticating-portal-xbvfkmcgs) · InfoSec Write-ups · 0 upvotes · 0 comments - [Inside an Oracle Database SQL Injection Attack](https://daily.dev/posts/inside-an-oracle-database-sql-injection-attack-jmtkujhqh) · Huntress Blog · 0 upvotes · 0 comments - [SQL Injection: Why It Persists and How to Prevent It](https://daily.dev/posts/sql-injection-why-it-persists-and-how-to-prevent-it-a5i6fyqpz) · Latest Hacking News · 0 upvotes · 0 comments - [Snowflake software update caused 13-hour outage across 10 regions](https://daily.dev/posts/snowflake-software-update-caused-13-hour-outage-across-10-regions-yhfjik31v) · InfoWorld · 0 upvotes · 0 comments - [Snowflake Performance Tips and Tricks — Part 5](https://daily.dev/posts/snowflake-performance-tips-and-tricks-part-5-mounpgvlh) · Snowflake Community · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#snowflake](https://daily.dev/tags/snowflake) [View this post on daily.dev](https://daily.dev/posts/snowflake-sql-injection-via-compile-time-constant-folding-with-system-wait-j7j8enpzx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT","url":"https://daily.dev/posts/snowflake-sql-injection-via-compile-time-constant-folding-with-system-wait-j7j8enpzx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/snowflake-sql-injection-via-compile-time-constant-folding-with-system-wait-j7j8enpzx"},"datePublished":"2026-08-05T07:18:42.891Z","dateModified":"2026-08-05T07:19:17.572Z","description":"A security researcher discovered a novel SQL injection extraction technique against Snowflake backends where standard error-based payloads were silently...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8b42061b2966f46568f87e9f3dd2e26a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8b42061b2966f46568f87e9f3dd2e26a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/snowflake-sql-injection-via-compile-time-constant-folding-with-system-wait-j7j8enpzx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,snowflake","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT"}]} ```