' OR 1=1 -- -

SQL Injection, end to end

A working reference for finding, exploiting, and preventing SQL injection — detection through escalation, five database engines, prevention in seven languages, and a live sandbox to practise in.

Start with the basicsTry the sandbox

Guides

33 guides from fundamentals to RCE, across five engines.

DBMS Cheatsheet

Every operation side by side for MySQL, Postgres, MSSQL, Oracle, SQLite.

Payload Generator

Build a payload for any engine, technique, and context.

Live Sandbox

Inject a real SQLite database running in your browser.

Browse the guides

For authorized testing only. Everything on this site is for security education and testing systems you have written permission to test. Unauthorized testing is illegal.