# SQLi - fundamentals

{% embed url="<https://github.com/payloadbox/sql-injection-payload-list>" %}

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FtkZrQbdoIGh55s5uuZbK%2FUntitled%20picture.png?alt=media&#x26;token=8277b9fd-4609-4c6f-ad5e-c46c9395d1a0" alt=""><figcaption></figcaption></figure>

{% embed url="<https://owasp.org/Top10/A03_2021-Injection/>" %}

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FNM1R4c1xAoop8yxFzypL%2FUntitled%20picture.png?alt=media&#x26;token=5c8ab6d0-23ee-4ac6-ac1c-95dbe548761e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FHAopIRQuPIBzJxBuIkyR%2FUntitled%20picture.png?alt=media&#x26;token=3e8bfc8e-ad20-4913-a479-7ba1959064b1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FSzy4hM7LgTzD0zoyy12F%2FUntitled%20picture.png?alt=media&#x26;token=5fca3262-99bf-4427-9aed-488ccba3b396" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FoQUStWEkmuuhNdE8I0sD%2FUntitled%20picture.png?alt=media&#x26;token=3ea4d4c9-b5d5-4637-9670-f01f9954ae36" alt=""><figcaption></figcaption></figure>

test' OR 1=1; -- #where 1 is the admin user id number in the db

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FaQoXWWDagviQkOuxlwXu%2FUntitled%20picture.png?alt=media&#x26;token=78c6121b-a78c-427e-818e-666038070169" alt=""><figcaption></figcaption></figure>

**DEFENSE:**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FWDEoseym4ZD5s8RTLGtY%2FUntitled%20picture.png?alt=media&#x26;token=6c2d7fe9-5b91-4491-a425-7060ecab606f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F3V7t2zuxRAxxhdxfBpVw%2FUntitled%20picture.png?alt=media&#x26;token=ec56f979-cd61-4ea8-812e-302e517b5fe3" alt=""><figcaption></figcaption></figure>

[https://cheatsheetseries.owasp.org/cheatsheets/Injection\_Prevention\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.htmlhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)[\
https://cheatsheetseries.owasp.org/cheatsheets/SQL\_Injection\_Prevention\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.htmlhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)

SQL Injection payloads:

&#x20;'OR 1 OR'

'1 OR 1=1; --

{% embed url="<https://www.ired.team/offensive-security-experiments/offensive-security-cheetsheets/sql-injection-xss-playground>" %}
