SQL Injection Deep Dive
February 12, 2026
Today's meeting covered the basics of SQL (Structured Query Language) Injection, a web vulnerability that occurs when user-supplied data is processed by a SQL database in an unsafe manner. The session focused on how attackers can manipulate database queries to bypass authentication, access unauthorized data, and even map out entire database schemas. Members were then given a set of challenges to practice these techniques on.
How SQL Injection Works
SQL is the standard language used to manage and manipulate relational databases. In a typical web application, the server takes input from a user (like a username or password) and inserts it into a predefined SQL string to fetch data. For example, a standard login query might look like this:
SELECT * FROM users WHERE username='[user_input]' AND Password='[pass_input]';The vulnerability occurs when a user is allowed to communicate with the database directly, because the database engine cannot inherently distinguish between the "data" provided by the user and the "commands" written by the developer. If the application fails to properly sanitize or escape special characters (for example a single quote '), an attacker can input characters that "break out" of the intended data string and append new SQL commands to the original query.
Tautologies (Authentication Bypass)
By inputting ' OR 1=1; --, an attacker can transform the logic of a query. Since 1=1 is always true, the database returns the first record in the table (usually the admin) without needing a valid password. The -- sequence comments out the rest of the original query, preventing syntax errors.
UNION-Based Injection
This technique uses the UNION operator to combine the results of the original query with a completely different table. This allows attackers to "join" data from sensitive areas, such as a secret_table or system metadata tables, and display it directly on the webpage.
Master Tables
Attackers can use injections to query the sqlite_master or information_schema tables. These contain the "blueprints" of the database, revealing table names and column structures, which serves as a roadmap for further attacks.
Blind SQL Injection
In cases where the page doesn't display database results directly, we use Blind SQLi. This involves asking the database "True or False" questions using the LIKE operator and wildcards (e.g., password LIKE 'a%'). By observing whether the page loads normally or returns an error, an attacker can brute-force sensitive information character by character.