DBMS Cheatsheet
The same operation across all five engines. Each column links to its full DBMS reference. Fingerprint the engine first — see Detection.
| Operation | MySQL / MariaDB | PostgreSQL | MSSQL | Oracle | SQLite |
|---|---|---|---|---|---|
| Comment to end of line | -- - or # | -- - | -- - | -- - | -- - |
| Version | @@version | version() | @@version | banner FROM v$version | sqlite_version() |
| Current user | CURRENT_USER() | current_user | SYSTEM_USER | user FROM dual | — (no users) |
| Current database | DATABASE() | current_database() | DB_NAME() | SYS_CONTEXT('USERENV','DB_NAME') | PRAGMA database_list |
| String concatenation | CONCAT(a,b) 'a' 'b' | a || b | a + b | a || b | a || b |
| Substring | SUBSTRING(s,1,1) | SUBSTRING(s FROM 1 FOR 1) | SUBSTRING(s,1,1) | SUBSTR(s,1,1) | SUBSTR(s,1,1) |
| Char code of char | ASCII(c) | ascii(c) | ASCII(c) / UNICODE(c) | ASCII(c) | UNICODE(c) |
| Time delay | SLEEP(5) | pg_sleep(5) | WAITFOR DELAY '0:0:5' | DBMS_PIPE.RECEIVE_MESSAGE('a',5) | — (use randomblob) |
| First row only | LIMIT 1 | LIMIT 1 | TOP 1 | WHERE ROWNUM=1 | LIMIT 1 |
| List tables | information_schema.tables | information_schema.tables / pg_tables | sysobjects WHERE xtype='U' | all_tables | sqlite_master WHERE type='table' |
| List columns | information_schema.columns | information_schema.columns | syscolumns / information_schema.columns | all_tab_columns (UPPERCASE names) | sqlite_master.sql / pragma_table_info |
| Aggregate rows | GROUP_CONCAT(c) | string_agg(c,',') | STRING_AGG / FOR XML PATH | LISTAGG(c,',') | group_concat(c) |
| SELECT without table | SELECT 1 | SELECT 1 | SELECT 1 | SELECT 1 FROM dual | SELECT 1 |
| Stacked queries | Rarely (driver-dependent) | Yes (simple protocol) | Always | No | exec() yes, prepare() no |
| Read a file | LOAD_FILE() | pg_read_file() | OPENROWSET(BULK …) | UTL_FILE | — (not possible) |
| Write a file | INTO OUTFILE / DUMPFILE | COPY TO / lo_export | OLE automation | UTL_FILE | ATTACH DATABASE |
| Command execution | UDF / webshell | COPY TO PROGRAM | xp_cmdshell | Java SP / DBMS_SCHEDULER | — (load_extension, disabled) |
| Error-based extraction | extractvalue / updatexml | CAST to int | CONVERT to int | XMLType / CTXSYS | — (dynamic typing) |
A dash means the operation is unavailable on that engine. Escalation rows (file, command) require privileges an application account should not hold — see Defense in Depth.