SQL Injection Testing: A Complete Guide
Introduction
SQL Injection (SQLi) is one of the oldest and most dangerous vulnerabilities in web applications. It allows
attackers to manipulate SQL queries by injecting malicious input, often leading to data exposure,
unauthorized access, or even full system compromise. Despite being well-documented, SQLi continues to
appear in real-world applications today.
In this blog, we’ll explore what SQL Injection is, its types, how to test for it, real-world examples, and
effective prevention methods.
SQL Injection Concept
What is SQL Injection?
SQL Injection occurs when untrusted user input is directly included in SQL queries without proper
sanitization or parameterization. This can give attackers the ability to alter queries and interact with the
backend database in unintended ways.
Example of vulnerable query:
SELECT * FROM users WHERE username = '" + user + "' AND password = '" + pass +
"';
If the user supplies this input:
' OR '1'='1
The query becomes:
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '';
This will always return true, potentially bypassing authentication.
Login Bypass Example
1
Types of SQL Injection
1. In-Band SQLi (Classic)
• Error-based SQLi: Leverages database error messages to extract information.
• Union-based SQLi: Uses the UNION keyword to combine results from different queries, exposing
sensitive data.
Union-based SQLi
2. Blind SQLi (Inferential)
• Boolean-based Blind: Injects conditions to infer database information by analyzing responses.
• Time-based Blind: Uses functions like SLEEP() or WAITFOR DELAY to trigger response delays,
confirming vulnerabilities.
3. Out-of-Band SQLi
• Uses external channels (like DNS or HTTP requests) to exfiltrate data. Often discovered with tools like
Burp Collaborator.
How to Test for SQL Injection
Step 1: Identify Input Points
Check URL parameters, form fields, cookies, and headers. Example:
[Link]
Step 2: Inject Basic Payloads
Try simple payloads such as:
' OR '1'='1
" OR "1"="1
' OR 'a'='a
Step 3: Look for Errors
A vulnerable app may return messages like:
2
You have an error in your SQL syntax;
Warning: mysql_fetch_array()
Step 4: Union-Based Testing
?id=1 UNION SELECT null,null --
?id=1 UNION SELECT username,password FROM users --
Step 5: Boolean-Based Blind Testing
?id=1 AND 1=1 -- page loads normally
?id=1 AND 1=2 -- page behaves differently
Step 6: Time-Based Blind Testing
?id=1' AND SLEEP(5)--
If the response is delayed, the site is vulnerable.
Testing SQLi
Practical Example: Login Bypass
A vulnerable login query:
SELECT * FROM users WHERE username = '" + user + "' AND password = '" + pass +
"';
Injected Input: - Username: ' OR '1'='1 - Password: ' OR '1'='1
Resulting Query:
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '' OR '1'='1';
This query returns all users, allowing unauthorized login.
SQLi Login Bypass
3
Real-World Impact
• Bypass authentication (account takeover)
• Extract sensitive data (emails, credit cards, passwords)
• Modify or delete critical data
• Potential Remote Code Execution (RCE)
• Full system compromise
How to Prevent SQL Injection
1. Use Parameterized Queries (Prepared Statements)
[Link]("SELECT * FROM users WHERE username = ? AND password = ?",
(username, password))
2. Apply Input Validation and Whitelisting
3. Use Stored Procedures (safely designed)
4. Enforce Least Privilege on Database Accounts
5. Deploy a Web Application Firewall (WAF)
6. Perform Regular Security Testing (VAPT, Code Review)
Prevention Methods
Conclusion
SQL Injection remains a powerful attack vector due to insecure coding practices. As testers, we should
always validate input points, attempt common payloads, and confirm vulnerabilities using systematic
methods. As developers, adopting secure coding practices such as parameterized queries and least-
privilege access is essential.
By combining proactive testing with secure development, organizations can significantly reduce the risk of
SQL Injection attacks.
Written by [Your Company Name], experts in Web Application Security and Penetration Testing.