Common Language and Database Stacks

Web applications typically pair a server-side language or framework with a specific database. Knowing the common pairings helps narrow down which SQL injection payloads, fingerprinting queries, and escalation techniques to try first.

Typical pairings

Language / Framework	Database	Notes
PHP	MySQL / MariaDB	The classic LAMP stack; historically most SQLi-prone
.NET (ASP.NET, C#)	Microsoft SQL Server	Enterprise Windows environments
Python (Django, Flask)	PostgreSQL, MySQL, SQLite	Django ORM reduces raw SQLi; raw queries still vulnerable
Java (Spring, J2EE)	Oracle, PostgreSQL, MySQL	Enterprise; J2EE’s programmatic interfaces reduce but don’t eliminate SQLi
Ruby on Rails	PostgreSQL, MySQL, SQLite	ActiveRecord ORM; raw SQL via find_by_sql is the risk
Node.js (Express)	MongoDB, PostgreSQL, MySQL	NoSQL injection for MongoDB; SQLi for relational backends

Why it matters for SQLi

1. Payload selection — PHP+MySQL means trying @@version, CONCAT(), and # comments first. .NET+MSSQL means @@version, + concatenation, and WAITFOR DELAY.
2. Fingerprinting efficiency — the stack narrows the DBMS candidates before sending a single fingerprinting query.
3. Escalation path — MySQL leads to INTO OUTFILE; MSSQL leads to xp_cmdshell; PostgreSQL leads to COPY ... TO PROGRAM.

SQLi prevalence by stack

OWASP notes that SQLi is historically most common in PHP and ASP applications due to the prevalence of older functional interfaces that encourage string concatenation. J2EE and ASP.NET’s programmatic interfaces (prepared statements, parameterized queries) make SQLi less likely — but any framework that allows raw SQL construction remains vulnerable.

Sources

• SQL Injection — OWASP
• SQL injection — PortSwigger Web Security Academy

See also

• sql-injection-attacks — the hub page for SQLi types and defense
• database-fingerprinting — confirm the DBMS before committing to payloads
• common-sql-variables — recon variables for the identified DBMS
• php — the language most associated with SQLi
• mysql-into-outfile-webshell — MySQL escalation
• ms-sql-server — MSSQL attack surface