SQL Injection — Live Lab

A real SQLite database (fresh in-memory copy per request) behind a login form and a product search. Flip modes to see string-built queries fall to injection, and parameterized queries hold.

Educational purpose only. Vulnerable mode really concatenates your input into SQL and executes it. Only try it against this local demo — never against systems you don't own or have permission to test.
⚠ Vulnerable mode ✓ Secure mode
Authentication Bypass
Username field:
' OR '1'='1'--
admin'--
' OR 1=1--
Data Extraction (tautology-based dump)
Search field (dumps every product):
' OR '1'='1'--
Union-Based Extraction
Search field (leaks the users table):
' UNION SELECT id, username, password FROM users--
Prevention

Every query on this page becomes injection-proof the moment user input is passed as a bound parameter instead of being spliced into the SQL string. Switch to Secure mode above and retry any payload — the database driver treats it as inert data, never as SQL.

• Parameterized queries / prepared
  statements (never string-format SQL)
• Least-privilege DB accounts
• Input validation as defense in depth
• ORMs that parameterize by default
• Web Application Firewall as a backstop
Seed Data
Modevulnerable
usersadmin, alice, bob
products4 rows