SQL Injection (SQLi)

When it applies

User input is concatenated into a SQL query. Test every param, header (X-Forwarded-For, User-Agent, Referer sometimes logged into DB), cookie, and JSON field — not just ?id=.

Why it works

The query string mixes code and data. A stray quote/operator lets you close the intended literal and append your own SQL, which the engine parses as instructions. Blind variants leak data one bit at a time via truthy/falsy responses or timing.

Method

Exact per-DB payloads, blind/error/time variants, and WAF bypasses: see cheatsheet.md next to this file. Work the whole variation set for a parameter before concluding it isn't injectable — one failed quote is not a clean param.