Repository navigation
I want the result of --sql-query to be saved as a CSV file. #5424
Description
Hi! How are you doing? I don't know if I can make this request without a 1 dollar sponsor.
I would love to see sponsor marks on future my GitHub accounts.
As you may have noticed, the results of -D DB -T TB -C A,B --dump and --sql-query="SELECT A,B FROM DB.TB" are slightly different. The latter simply saves to the output and log file.
Currently, I want to save the results to a CSV file when the -D option is not available in SQLMAP (version detection failed [I'll try to debug it!]) or when using the ORDER BY syntax(with --sql-query).
Thank you as always. Dear Stampar👍🏼
Activity
oguilhermegimenes commentedon Jun 4, 2023
nice idea
anauwal commentedon Mar 13, 2024
please make this available
Aridhi-Dhia-eddine commentedon Mar 29, 2024
Hello
I want to inderstand your prblem ; you mean that you have to use -D DB -T TB -C A,B --dump and you want to save the result in CSV File
or you have to use --sql-query="SELECT A,B FROM DB.TB" and you want to save the result in CSV file ?
mastercho commentedon Mar 29, 2024
That
Aridhi-Dhia-eddine commentedon Mar 29, 2024
but as i know it accept only one attribute in the request is it what you want? you want to store this value in CSV file ?
Aridhi-Dhia-eddine commentedon Apr 7, 2024
hello
just i want to know where the function "_saveToResultsFile" is called in the sqlmap project ?
AlexDevFlow commentedon Jul 7, 2026
I'd like to take this on. There's an open PR for it (#5685) that's been inactive since mid-2024, so if you're open to it I'd rather do a clean version built into the dumper.
Tracing the code, dbmsHandler.sqlQuery() hands back the values from inject.getValue() with multi-column rows already collapsed by joinValue() before the dumper sees them, and conf.dumpPath only gets created for --dump/--dump-all/--search, so a bare --sql-query has nowhere to write yet. My plan is to reuse --dump-format=csv instead of adding a flag, capture the structured rows before that join, and write them under the target's dump dir with the same safeCSValue() and --csv-del escaping a table dump uses, leaving the header off since an arbitrary SELECT has no reliable column names, unless you'd prefer something like col1,col2.
Does that work for you, or would you rather a dedicated option than reusing --dump-format=csv?
stamparm commentedon Jul 7, 2026
@AlexDevFlow please man. chances that i'll accept the merge request are virtually non-existent - most probably you'll run claude code and push - and i'll get pissed - i am just being honest here.
i am currently (in last weeks) doing HUGE changes internally - more the chance that i'll just close PRs without any looking. so, i could take this one on the back of my queue
AlexDevFlow commentedon Jul 7, 2026
Alright, it's just something I needed for work these days and figured it might help, but all good. I'll fork it as a custom version for myself, good luck with the changes