SQLi · SQL Injection
A few quotes. One admin account.
A payload in the username field is enough to rewrite the SQL query. Password verification disappears. The attacker logs in as admin without knowing a single credential.
- Auth bypass
- SQL payload
- Admin access
- OWASP A03
Step-by-step simulation
Follow the attack step by step
Sign in to your account
Username
Password
A standard login form
The application's front door, with a username and password
Every input field is an attack surface
Login forms, search bars, filters, URL parameters... anywhere a user value is passed to a database. If the code directly concatenates the input into the SQL query, the flaw exists by construction.
Key figures
An old flaw, still exploited
- OWASP Top 10
#0
Injection · A03:2021- To exploit
≤ 0 min
a vulnerable endpoint- Of vulnerable apps
0%
that concatenate input- To fix
0 line
with a parameterized query
Protection
How to protect yourself
SQL injection is fixed in code. These four measures close the door for good.
Parameterized queries
Always keep SQL code separate from data: prepared statements or an ORM, never concatenated user input.
Server-side validation
Check the expected format of every field (allow-list) before processing, even if the browser already did.
Least privilege
The application's database account can only reach the tables and rights it strictly needs.
Detection and testing
WAF, logging of abnormal queries and regular penetration tests to find a flaw before an attacker does.
Technical demo
Try it yourself
This simulation lets you inject a real SQL payload and watch the generated query live. Intended for technical teams and trainers.
SQL Injection
Login bypassed via payload
Generated SQL:
SELECT * FROM users WHERE email = '' AND password = '';
Authentication payload
' OR '1'='1' --
This string forces the condition to true, bypassing authentication if the query isn't parameterized.
Why it's critical
Here, the application directly uses the entered values to build a SQL query. An attacker can alter the query and log in as another user.
For a decision-maker, this means sensitive data can be exposed without the code ever knowing it was manipulated.
How to protect against it
- Never concatenate user text into a SQL query.
- Use parameterized queries.
- Validate and normalize inputs.
- Restrict database account permissions.
SELECT * FROM users WHERE email = $1 AND password = $2; -- bound values, no concatenation
FAQ
Frequently asked questions
What is a SQL injection?
A SQL injection is an application vulnerability that lets an attacker insert malicious SQL code into a database query. It can bypass authentication, extract data, modify or delete records, and sometimes execute system commands.
How does SQL injection authentication bypass work?
By injecting the payload ' OR '1'='1 into a login field, an attacker turns the SQL query into an always-true condition. The query becomes: SELECT * FROM users WHERE username='' OR '1'='1' -- AND password='...', which returns every user and grants admin access.
How do you prevent SQL injection?
Protections against SQL injection include: using prepared statements and ORMs, validating and encoding all user input, applying least privilege to database accounts, and using a WAF (Web Application Firewall).
What tools detect SQL injection?
SQL injection detection tools include: sqlmap (automated, open-source), Burp Suite (intercepting proxy), OWASP ZAP (vulnerability scanner), and DAST solutions built into CI/CD pipelines. WAFs (ModSecurity, Cloudflare) block them in production.
Train your teams with an expert
Tailored awareness workshops, attack simulations and training to anchor the right reflexes in your organization.