Live Sandbox

A real SQLite database, compiled to WebAssembly and running entirely in your browser. The endpoints below build their queries by string concatenation on purpose. Inject them, watch the actual query and result, then flip Safe mode to see the same input fail against a parameterised query.

The engine here is SQLite. Syntax differs across MySQL, PostgreSQL, MSSQL and Oracle — notably unicode() not ascii(), no SLEEP(), and sqlite_master in place of information_schema. See the cheatsheet and the SQLite reference. Nothing here leaves your browser.

Loading sandbox…

Seed schema

Three tables: users(id, username, password, email, role), products(id, name, price, category), notes(id, user_id, body). The products table has 3 columns and users has 5 — useful for lining up a UNION. Reset restores the seed at any time.

New to the techniques? Start with UNION-Based, Boolean-Blind, and Injection Contexts.