About sqli.page

sqli.page is a reference for SQL injection: how it happens, how to find and confirm it, how it is exploited across the major database engines, how it escalates, and — the part that actually matters — how to prevent it. It is written for security professionals, penetration testers, and developers who want to understand the vulnerability well enough to eliminate it.

What is here

• 33 guides across fundamentals, techniques, a per-engine reference, attack surfaces, evasion, escalation, prevention in seven languages, and testing methodology.
• A DBMS cheatsheet comparing syntax across MySQL, PostgreSQL, MSSQL, Oracle, and SQLite.
• A payload generator that builds payloads for a chosen engine, technique, and injection context.
• A live sandbox — a real SQLite database compiled to WebAssembly, running in your browser, that you can inject against and then defend with parameterisation.

The one thing to take away

Every technique on this site exists because a query was built by concatenating strings. There is one complete fix — parameterised queries — and a set of mitigations that limit the damage when a query is missed. If you read one guide, read How Injection Happens; if you read two, add Defense in Depth.

Authorized use only

The techniques and payloads here are for authorized security testing and education. Testing a system you do not own or have explicit written permission to test is illegal in most jurisdictions. The guides assume you have that authorization, and several — file write, command execution, privilege escalation — call out where you need it explicitly and in writing.

Sibling sites

sqli.page shares its shape with a small family of vulnerability references: xss.page, ssrf.page, and xxe.page.

Corrections

Found an error, a stale payload, or a missing case? Issues and pull requests are welcome on GitHub.