SQL Injection Resources

SQL Injection

SQL injection (SQLi) is the insertion of malicious SQL queries via input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify or delete records, execute administrative operations, and in some cases issue commands to the operating system.

Despite being one of the oldest web vulnerability classes, SQL injection continues to appear in modern applications — particularly in legacy codebases, custom query builders, and applications that construct SQL through string concatenation rather than parameterized queries. Second-order SQLi, where the payload is stored first and executed later in a different context, is especially difficult to detect with automated scanners.

SQLi techniques have evolved well beyond simple UNION SELECT attacks. Blind SQLi uses boolean conditions or time delays to extract data one bit at a time. Error-based injection leverages database error messages to leak information. Out-of-band SQLi exfiltrates data through DNS or HTTP requests initiated by the database. Each database engine — MySQL, PostgreSQL, MSSQL, Oracle, SQLite — has its own syntax quirks and exploitation techniques.

Modern WAFs and prepared statements have reduced the attack surface, but bypasses are regularly discovered through encoding tricks, comment injection, and parser differentials between the WAF and the database.

This page collects SQLi techniques, cheat sheets, bypass methods, and real-world exploitation writeups across all major database platforms.

From OWASP