SelfSecSelfSec
Vulnerability field guide

SQL Injection

SQL injection is still one of the most damaging web vulnerabilities. Here is how it actually works, what an attacker can do with it, and the one fix that reliably stops it.

8 articles36 min totalOverview to advanced techniques
Start here' OR '1'='1' -- -
Step 01 · Start with the overview
SQL Injection6 min read

SQL Injection, Explained: From Login Bypass to Full Data Extraction

SQL injection is still one of the most damaging web vulnerabilities. Here is how it actually works, what an attacker can do with it, and the one fix that reliably stops it.

Read the overview
Continue the field guide

SQL Injection techniques

7 focused deep-dives
  1. 02Boolean-Based BlindBoolean-Based Blind SQL Injection: Extracting Data One Bit at a Time4 min
  2. 03Error-BasedError-Based SQL Injection: Turning Database Errors Into Data4 min
  3. 04Out-of-BandOut-of-Band SQL Injection: Confirming a Blind Flaw Through DNS5 min
  4. 05Second-OrderSecond-Order SQL Injection: When Stored Input Detonates Later4 min
  5. 06Stacked QueriesStacked Queries: Running Multiple Statements Through One Injection4 min
  6. 07Time-Based BlindTime-Based Blind SQL Injection: Reading a Database Through the Clock5 min
  7. 08UNION-BasedUNION-Based SQL Injection: Appending Your Own Result Set4 min