Web Application Hacking (Hands-On)
SQL Injection — Concept + Live Lab
Break authentication and steal data by injecting SQL. Then do it for real.
Open the interactive lesson & lab →
SQL injection happens when user input is concatenated straight into a database query. By injecting SQL syntax, you change what the query does — bypassing logins or dumping the whole database.
Why it works
Imagine a login query built like this:
SELECT * FROM users
WHERE username = '" + input + "' AND password = '" + input + "'If you enter the username admin'-- the query becomes:
SELECT * FROM users WHERE username = 'admin'-- ' AND password = '...'The -- comments out the password check. You're logged in as admin without a password.
Two payloads to try in the lab
- Auth bypass — username: admin'-- (any password)
- Always-true bypass — username: ' OR '1'='1'--
- Data theft (search box) — UNION SELECT to pull columns from the users table.