CRITICAL SEVERITYCWE-89OWASP A03:2021

SQL Injection

SQL Injection (SQLi) is a code injection technique that exploits security vulnerabilities in an application's database layer. Attackers can execute arbitrary SQL queries to read, modify, or delete data, and in some cases, execute system commands.

9.8

CVSS Score

40+

Payloads

All

Affected DBs

Critical

Risk Level

Payload Database

Simple SQL injection payloads for initial testing

' OR '1'='1

Always true condition

' OR '1'='1'--

Comment out rest of query

' OR '1'='1'/*

MySQL comment syntax

admin'--

Bypass login as admin

' OR 1=1#

MySQL hash comment

') OR ('1'='1

Parentheses escape

1' ORDER BY 1--+

Find number of columns

1' ORDER BY 10--+

Column count probing

Vulnerable Code Example

VULNERABLE CODE - DO NOT USE

// PHP - Vulnerable to SQL Injection
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

// Python - Vulnerable
query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
cursor.execute(query)

// Node.js - Vulnerable
const query = `SELECT * FROM users WHERE username='${username}' AND password='${password}'`;
db.query(query);

Secure Code Example

SECURE CODE - USE PARAMETERIZED QUERIES

// PHP - Prepared Statement
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();

// Python - Parameterized Query
query = "SELECT * FROM users WHERE username=%s AND password=%s"
cursor.execute(query, (username, password))

// Node.js - Parameterized Query
const query = 'SELECT * FROM users WHERE username=$1 AND password=$2';
db.query(query, [username, password]);

Prevention Checklist

Use prepared statements with parameterized queries

Implement stored procedures

Apply strict input validation (whitelist)

Escape all user-supplied input

Use an ORM (Object Relational Mapping)

Implement least privilege database access

Enable WAF (Web Application Firewall)

Regular security audits and code reviews

Related Resources

OWASP SQL Injection PortSwigger Academy HackTricks SQLi

Vulnerable Code Example

VULNERABLE CODE - DO NOT USE

// PHP - Vulnerable to SQL Injection
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

// Python - Vulnerable
query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
cursor.execute(query)

// Node.js - Vulnerable
const query = `SELECT * FROM users WHERE username='${username}' AND password='${password}'`;
db.query(query);

Secure Code Example

SECURE CODE - USE PARAMETERIZED QUERIES

// PHP - Prepared Statement
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();

// Python - Parameterized Query
query = "SELECT * FROM users WHERE username=%s AND password=%s"
cursor.execute(query, (username, password))

// Node.js - Parameterized Query
const query = 'SELECT * FROM users WHERE username=$1 AND password=$2';
db.query(query, [username, password]);