beginner · web-security · 150 points · 0 working it

SQL Injection: Reading the Database

A product search endpoint is concatenating input into its query. Walk through confirming the injection, understanding why it works, and extracting data safely in a lab sandbox.\n\nAll payloads below are for learning — never run them against systems you do not own or have written permission to test.

Find the injection point
The app searches products with:
```
GET /search?id=7
```
The backend builds the query with string concatenation:
```
SELECT name, price FROM products WHERE id = ' + <id>
```
Any value that keeps the SQL valid but changes its meaning is injectable. The single name of the injected request parameter is the checkpoint.
Which request parameter is concatenated unsanitized?
Hint
It appears once in the request line.
Sign in to verify this checkpoint.
Confirm without breaking the app
Send id=1 AND 1=1 then id=1 AND 1=2. If the first returns data and the second does not, your input is evaluated as SQL. The two-dash comment is the standard way to neutralize the rest of the original query after your injection.
What two-character sequence comments out the remainder of an SQL statement?
Hint
It starts a comment in standard SQL — the same thing after the OR-probe in the walkthrough.
Sign in to verify this checkpoint.
Extract data with UNION
Column-count first: id=1 ORDER BY 1, ORDER BY 2 … until it errors. With N columns known, id=-1 UNION SELECT username, password FROM users leaks rows through the same response. Checkpoint: the column you would select first from a users table.
Name the users-table column you UNION SELECT first for account names.
Hint
It stores login names — not the password.
Sign in to verify this checkpoint.