Payloads.site / Payload Guides / SQL Injection
SQL Injection (SQLi) Payloads & Techniques
SQL injection (SQLi) occurs when untrusted input is concatenated into a SQL query without proper parameterization, letting an attacker alter query logic, extract data, or in some cases affect the underlying database server. It remains one of the most common web application vulnerabilities and is a standard target during authorized penetration tests and bug bounty engagements.
Common Injection Contexts
- Numeric — input is used directly in a numeric
field with no quoting, e.g.
id=1 OR 1=1. - String — input is wrapped in quotes; the payload must close and reopen the string to inject logic.
- UNION-based — a
UNION SELECTis appended to pull data from other tables into the visible output. - Error-based — malformed input forces verbose database errors that leak schema or data.
- Blind / time-based — true/false conditions are inferred from response differences or induced delays when no output is returned directly.
Representative Example Payloads
' OR '1'='1' -- " OR "1"="1 1 OR 1=1 ' UNION SELECT NULL,NULL,NULL-- ' AND SLEEP(5)-- admin'--
These patterns illustrate the underlying technique only. Real-world testing requires adapting the payload to the specific query context, database engine, and any input filtering in place — see the full, searchable payload library and encoder for a much larger, regularly updated set. The primary defense against SQL injection is the consistent use of parameterized queries (prepared statements), which keep user input separate from query structure regardless of its content.
Further reading: PortSwigger – SQL injection
⚠️ For educational purposes and authorized security testing only. Do not test systems you do not own or lack explicit permission to test.
Other payload guides