'Is the main algorithm for finding blind SQL injections.
:return: A vulnerability object or None if nothing is found'

def _find_bsql(self, mutant, statement_tuple, statement_type):

    true_statement = statement_tuple[0]
    false_statement = statement_tuple[1]
    send_clean = self._uri_opener.send_clean
    mutant.set_token_value(true_statement)
    (_, body_true_response) = send_clean(mutant)
    mutant.set_token_value(false_statement)
    (_, body_false_response) = send_clean(mutant)
    if (body_true_response == body_false_response):
        msg = 'There    is    NO    CHANGE    between    the    true    and    false    responses.    NO    WAY    w3af    is    going    to    detect    a    blind    SQL    injection    using    response    diffs    in    this    case.'
        self.debug(msg, mutant)
        return None
    compare_diff = False
    self.debug(('[%s]    Comparing    body_true_response    and    body_false_response.' % statement_type), mutant)
    if self.equal_with_limit(body_true_response, body_false_response, compare_diff):
        self.debug('Setting    compare_diff    to    True', mutant)
        compare_diff = True
    mutant.set_token_value(self.SYNTAX_ERROR)
    (syntax_error_response, body_syntax_error_response) = send_clean(mutant)
    self.debug(('[%s]    Comparing    body_true_response    and    body_syntax_error_response.' % statement_type), mutant)
    if self.equal_with_limit(body_true_response, body_syntax_error_response, compare_diff):
        return None
    search_disambiguator = self._remove_all_special_chars(true_statement)
    mutant.set_token_value(search_disambiguator)
    (_, body_search_response) = send_clean(mutant)
    self.debug(('[%s]    Comparing    body_true_response    and    body_search_response.' % statement_type), mutant)
    if self.equal_with_limit(body_true_response, body_search_response, compare_diff):
        return None
    statements = self._get_statements(mutant)
    second_true_stm = statements[statement_type][0]
    second_false_stm = statements[statement_type][1]
    mutant.set_token_value(second_true_stm)
    (second_true_response, body_second_true_response) = send_clean(mutant)
    mutant.set_token_value(second_false_stm)
    (second_false_response, body_second_false_response) = send_clean(mutant)
    self.debug(('[%s]    Comparing    body_second_true_response    and    body_true_response.' % statement_type), mutant)
    if (not self.equal_with_limit(body_second_true_response, body_true_response, compare_diff)):
        return None
    self.debug(('[%s]    Comparing    body_second_false_response    and    body_false_response.' % statement_type), mutant)
    if self.equal_with_limit(body_second_false_response, body_false_response, compare_diff):
        response_ids = [second_false_response.id, second_true_response.id]
        desc = 'Blind    SQL    injection    was    found    at:    "%s",    using    HTTP    method    %s.    The    injectable    parameter    is:    "%s"'
        desc %= (mutant.get_url(), mutant.get_method(), mutant.get_token_name())
        v = Vuln.from_mutant('Blind    SQL    injection    vulnerability', desc, severity.HIGH, response_ids, 'blind_sqli', mutant)
        om.out.debug(v.get_desc())
        v['type'] = statement_type
        v['true_html'] = second_true_response.get_body()
        v['false_html'] = second_false_response.get_body()
        v['error_html'] = syntax_error_response.get_body()
        return v
    return None
