SQL Injection Sandbox
A fake login backed by a simulated database. Watch your input become SQL, then bypass the login with a classic injection.
SQL injection happens when input is glued into a query as text instead of passed as data. This lab shows you the query being built as you type, so you can watch your input stop being a username and start being SQL.
How to use it
- Enter a normal username and watch the query that gets built.
- Break out of the string context with a quote.
- Make the WHERE clause always true and log in as the first user.
What to take away
Watch the quotes
The classic ' OR '1'='1 works by closing the string the developer opened and appending a condition that is always true.
Parameterised queries are the fix
They send the query structure and the data on separate channels, so input cannot change the meaning of the statement. Escaping input is a workaround; this is a fix.
Blind SQLi has no error messages
Real targets often show nothing. Attackers infer answers from behaviour differences or response timing instead — slower, equally effective.
Frequently asked questions
Is SQL injection still a real problem?
Yes. It remains in the OWASP Top 10 as part of Injection, and it still appears in breach reports — mostly in older code and hand-built queries that predate the team's current standards.
Do ORMs make you safe?
Mostly, because they parameterise by default. They stop protecting you the moment someone drops to raw SQL with string concatenation, which every ORM allows.
What is the difference between SQLi and NoSQL injection?
The same class of flaw in a different query language. MongoDB operators injected through JSON produce the same effect as ' OR 1=1 does in SQL.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Vulnerable Web App — A tiny deliberately-broken app for practicing XSS and login-bypass. Runs entirely in-browser; no server to attack, nothing to install.
- Command Injection Sandbox — A "ping this host" tool glues your input into a real shell command. Chain a second command onto the intended one.
- Secure Code Review Toy — Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.
- Race Condition Lab — A one-time coupon, redeemed with a check-then-act flaw. Fire requests fast enough and redeem it far more than once.