I just got a PEN-Test result from a web application. The tester stated they were able to use the *ORDER BY* clause of a dynamic SQL statement to retrieve information.
The name of the column that should be sorted is passed into the query by an app. The tester modified the value so it contains a complex statement that looks like `CASE WHEN ... THEN 1 ELSE 1/0 END`.

However, I built a very simple test case. I have an Oracle database and a SQLServer. Both contain the same tables. I query

```
SELECT * FROM users ORDER BY 1/0

```

When I execute this in Oracle the query executes fine. In SQLServer I get an error `8134 Divide by zero error encountered.`.

As the PEN-Tester was using the app on a different Oracle server than I'm using now and they report they were abusing the fact that Oracle eventually threw errors, I wonder if there's an Oracle setting that prevents the execution of *ORDER BY* clauses that evaluate to a division by zero. Is there such a setting? Is it a matter of Oracle Version in use? I'm on `12.1.0.2.0` where no exception is thrown. Is there such a setting in SQLServer, too?

I will of course modify the generation of the statement, so it checks if the values that are passed in are column aliases available for sorting.