SQL Fundamentals

Before exploiting SQL injection you need to understand SQL itself: how queries are built, how user input is concatenated into them, and how the syntax differs between database engines. The same injection often needs different payloads on MySQL, MSSQL, PostgreSQL, and Oracle. This module covers the SQL fundamentals and dialect differences that underpin every injection technique, then how to reliably detect an injectable parameter in a black-box target.

SQL Fundamentals and Dialects

A SQL injection exists because untrusted input is placed directly into a query. Understanding query structure (SELECT, WHERE, UNION, subqueries, stacked statements) tells you where and how to break out of the intended query. Each engine has its own comment syntax, string functions, metadata tables, and version-specific quirks, so identifying the backend early determines which payloads will work.

Detecting SQL Injection

Detection confirms that input reaches a query in an exploitable way. Error-based probes surface database error messages, boolean-based tests compare true/false responses, and time-based payloads confirm blind injection by measuring response delay. Injection is not limited to GET and POST body parameters: headers, cookies, and JSON fields are all candidates. Authentication bypass payloads and PHP loose-comparison hash tricks are quick wins worth testing on login forms.