How it works
SQL injection happens when user input is concatenated into a query instead of bound as a parameter. The testing progression is always the same: detect with a quote, confirm with a true/false pair, enumerate structure with ORDER BY or UNION, then choose an extraction technique that matches what the application reveals — visible output, error messages, boolean differences, or only timing.
This reference organizes payloads by technique (detection, auth bypass, UNION, error-based, boolean blind, time blind, stacked, WAF-evasion checks) and by database where syntax diverges (MySQL, PostgreSQL, MSSQL, SQLite). Every entry states its purpose, so you read the response instead of firing blindly. Search and filters narrow the list; each payload copies raw or URL-encoded for direct use in a proxy or terminal.
Two payloads define the whole methodology: ' AND '1'='1 renders normally, ' AND '1'='2 removes content. That true/false pair confirms boolean injection without extracting anything — and it is the same pair you use to verify a fix: after parameterizing, both should render identically (and safely).
Authorized testing only. Use these against systems you own or have explicit written permission to assess. The remediation section pairs every technique with its fix: parameterized queries, least-privilege database users, suppressed error details, and WAF rules as a second layer — never as the primary defense.
Worked example
Confirm a boolean injectable parameter on your own app: the true condition renders the page, the false one drops content.
| Probe | Expected if injectable | What it proves |
|---|---|---|
1' AND '1'='1 | Page renders normally | Input reaches the query as syntax. |
1' AND '1'='2 | Content disappears | You control the WHERE logic — boolean channel confirmed. |
' ORDER BY 5-- - | Error at column 5 | The query has exactly 4 columns for UNION work. |
- Filter the library: Pick a technique and database, or search a keyword like sleep or union.
- Understand the purpose: Each payload states what response proves it worked.
- Copy raw or encoded: Use the URL-encoded copy when injecting through query strings.
- Verify the fix: After patching, replay the same probes and expect safe, identical output.
From there, ' UNION SELECT NULL,NULL,NULL,NULL-- - aligns the column count and reveals which positions are reflected. Time-based confirmation (' OR SLEEP(5)-- - on MySQL) works even when nothing is reflected at all — a five-second delay is the signal.
Common errors and edge cases
- Comment syntax differs.
-- -needs a trailing space (or plus) in MySQL;#is MySQL-only; MSSQL and Postgres prefer--. A payload that “fails” may just be mis-commented. - UNION requires matching columns. Count them with ORDER BY first, and match types — put strings in string-typed positions.
- No sleep() in SQLite. Time-based confirmation needs heavy computation such as randomblob instead.
- WAFs are bypassable by design. Case variation, comments and encoding gaps are why a WAF is a second layer, not the fix. Parameterized queries are the fix.
- Errors leak more than injection. Stack traces reveal schema, paths and versions. Suppress detailed errors in production regardless of injection status.
Code equivalents
Detection is one discipline; the fix is another. These snippets show the parameterized pattern that closes injection in each stack.
| Stack | Safe pattern |
|---|---|
| Node (pg) | client.query('SELECT * FROM users WHERE id = $1', [id]) — placeholders, never concatenation. |
| Python (psycopg) | cur.execute('SELECT * FROM users WHERE id = %s', (uid,)) — the driver quotes and binds. |
| PHP (PDO) | $pdo->prepare('SELECT * FROM users WHERE id = ?'); $stmt->execute([$id]); |
Related tools
Frequently asked questions
What is the correct order to test a parameter?
Quote for errors, then a true/false pair for boolean confirmation, ORDER BY for column count, UNION for visible extraction, and time-based payloads when nothing is reflected. Stop at the first technique that gives you what you need.
Is using these payloads legal?
Only on systems you own or have explicit written permission to test. Unauthorized injection attempts are crimes in most jurisdictions, regardless of intent.
Why does my payload need a trailing space after --?
MySQL requires whitespace after the double-dash comment; -- - (or --+) is the portable form. Without it, the comment does not start and the query breaks.
Does a WAF make SQL injection impossible?
No. WAFs filter known patterns; encoding, comments and case variants routinely bypass naive rules, as the evasion entries demonstrate. Parameterized queries are the only real fix — the WAF buys time, not safety.
How do I verify my fix actually works?
Re-run the detection pair: after parameterizing, ' AND '1'='1 and ' AND '1'='2 must render identically, quotes must be treated as data, and no database error may surface. Add the probes to your test suite.
Privacy note
All processing happens in your browser. The values you enter never leave your device and are never transmitted to ToolPlex.