Skip to main content
2026-07-29 16:01
Database

SQL Injection Prevention

QueryValidateHard
Try Interactive Demo

What you will learn

  • Never concatenate user input into SQL — parameterized queries are the only reliable defense
  • Test classic payloads: ' OR '1'='1, '; DROP TABLE users;--, UNION SELECT — API must reject or safely escape, never execute
  • ORMs don't save you automatically — raw query fragments (.orderByRaw, .whereRaw) are the same injection vector

Description

Understand how SQL injection works and how to prevent it.

Test Scenario

-- VULNERABLE CODE (DO NOT USE IN PRODUCTION):
-- "SELECT * FROM users WHERE name = '" + userInput + "'"

-- Attack input: ' OR '1'='1
-- Results in: SELECT * FROM users WHERE name = '' OR '1'='1'
-- Returns ALL users!

-- Try this query to see the effect:
SELECT * FROM users WHERE name = '' OR '1'='1';

-- SAFE: Use parameterized queries in real applications
-- SELECT * FROM users WHERE name = ?

Testing Tips

  • •Never concatenate user input directly
  • •Use parameterized queries
  • •Escape special characters
  • •This demo shows the vulnerability
// Playwright API Testing - Database
import { test, expect } from '@playwright/test';


test('Database query via API', async ({ request }) => {
  const response = await request.post('/api/database/query', {
    data: {
      sql: 'SELECT * FROM users WHERE id = ?',
      params: [1]
    }
  });


  expect(response.ok()).toBeTruthy();
  const { rows } = await response.json();
  expect(rows.length).toBeGreaterThan(0);
});

Challenge ID: sql-injection-demo

2 frameworks available