Skip to main content
SQL injection happens when user input gets concatenated straight into a database query instead of being treated as data. The impact ranges from reading data you shouldn’t to full remote code execution, depending on the database engine and how the application is configured. It splits into three main types, and two of those split further into subtypes based on exactly how you extract data. SQL Injection types and subtypes

In-Band

The result of your injected query shows up directly in the response. Splits into error-based, where database error messages leak data, and union-based, using UNION SELECT to pull data into the page’s normal output. Fast to exploit once confirmed.

Blind

Nothing comes back directly, so you infer data indirectly. Splits into boolean-based, reading true/false differences in the response, and time-based, reading delays like SLEEP() instead.
Out-of-band is the third, much rarer type: data gets exfiltrated through a completely separate channel, usually DNS or HTTP requests the database server makes on its own. It only works when the database can actually reach outside the network and in-band or blind methods are blocked or too slow.
Comment syntax ends the original query early so the rest of it gets ignored: --, #, and /**/ are the three you’ll use constantly, with a trailing space often required after -- for it to register as a comment.

​
Confirming the Injection

Before building out a full UNION chain, confirm injection actually exists and figure out what’s running behind it.
These two test the same thing in different quoting contexts: if the login bypasses or the query behaves differently, the input isn’t being sanitized. A time delay is one of the most reliable confirmations since it works even when the page gives no visible feedback at all:
If the response changes or includes version info, you’ve got a confirmed, visible injection point to build on.

​
Union-Based Injection

UNION injection appends your own query to the original and returns its result inline with the page’s normal output. It only works once the column count and data types line up with the original query. Find the column count by incrementing until the query errors out:
Once the count lines up, swap in real data one column at a time:
From there, pulling the actual schema is mostly a matter of querying INFORMATION_SCHEMA through the same injection point:
Depending on database privileges, UNION injection can go beyond reading tables.
INTO OUTFILE needs FILE privilege and a web-writable path, which is uncommon in a hardened setup but still worth checking, especially on older or misconfigured MySQL instances.

​
SQLMap

Manual injection is worth understanding, but sqlmap automates the actual extraction once you’ve confirmed a parameter is injectable. It’s usually the faster path from “this looks vulnerable” to a full data dump.
Once a parameter is confirmed injectable, these pull the actual data:
--level and --risk (both 1-5 and 1-3 respectively) control how thorough and aggressive sqlmap’s tests are. The defaults miss plenty of real injection points, bumping both up is often what turns a false negative into a confirmed finding.
For getting beyond data extraction into file access or a shell:
WebSocket endpoints need the connection confirmed separately before sqlmap can target them:

​
NoSQL Injection

Document databases like MongoDB don’t use SQL syntax, but the same core problem applies: unsanitized input lets an attacker change the logic of the query itself, usually by injecting query operators instead of string payloads. The classic case is an auth bypass, where $ne makes the condition true for any value other than the expected one:
A blind regex injection can extract data character by character when the field reflects true/false, similar in spirit to blind SQL injection:
NoSQL Injection payloads (PayloadsAllTheThings) has a much deeper payload list for both MongoDB and other NoSQL engines.

​
Quick Reference Tools

SQL Injection Techniques

Overview of injection techniques across different database engines.

SQL Injection Payload List

Ready-to-use payloads for manual testing.

PayloadsAllTheThings: SQL Injection

Deep, engine-specific reference covering MySQL, MSSQL, PostgreSQL, and more.
Destructive queries, file writes, and --os-shell can modify or damage the target application. Stick to read-only enumeration until impact is explicitly in scope.