SQL Injection Detector

Scan an input or query for SQL injection signatures and get a risk score

Input to scan

Risk assessment

0
none risk

0 signatures matched

Examples

Classic login bypass

Input
admin' OR '1'='1' --
Output
Risk: critical (score 100) — boolean-blind tautology + line comment.

OR '1'='1' makes the WHERE clause always true and the comment removes the rest of the query.

Data exfiltration

Input
1 UNION SELECT username, password FROM users
Output
Risk: critical — union-based injection.

UNION SELECT appends a second result set to read data from another table.

About this tool

SQL injection occurs when untrusted input is concatenated into a query and the database interprets it as code. Catching the signatures before they reach production is one of the cheapest ways to prevent a breach, because the patterns are well known.

This scanner runs a curated set of regular-expression signatures against the text you paste: boolean tautologies (OR 1=1), UNION SELECT exfiltration, stacked queries, line and block comments, time-based blind payloads (SLEEP / WAITFOR / pg_sleep), schema enumeration, destructive DROP/ALTER/TRUNCATE, and OS command execution (xp_cmdshell). Each match reports its severity and an explanation, the input is classified by injection type, and an overall 0–100 risk score shows how dangerous the payload is.

How to use

  1. Paste the suspect input

    Enter a payload, form value, or query fragment you want to screen.

  2. Read the risk score

    The 0–100 score and label tell you at a glance how dangerous the payload is.

  3. Review signatures

    Each matched pattern explains what it does and how an attacker would use it.

  4. Fix at the source

    Use the findings to justify parameterized queries and input validation in the affected code.

Common mistakes

Mistake:Treating a clean scan as proof of safety.

Fix:This is heuristic. Always use parameterized queries/prepared statements; signatures catch the obvious, not every variant.

Mistake:Only blocking the flagged keywords.

Fix:Keyword blocklists are bypassable. Fix the query construction (bind variables) instead of filtering words.

Frequently asked questions

Related guides

Two SQL Reviews Every Query Should Pass

A security review and a performance review for SQL. Catch injection signatures before production, then strip the anti-patterns that make a query slow — without needing a live database.

References & standards

Related tools

Lighthouse Audit Summary

Summarize a Lighthouse report into prioritized actions. Enter category scores or paste Lighthouse JSON to get grades, weakest areas, and a ranked improvement checklist.

SSL Chain Analyzer

Paste a PEM certificate bundle and verify the chain order — find missing intermediates, broken links, expired or not-yet-valid certificates, self-signed roots, and duplicates. All in-browser.

NoSQL Validator

Validate a JSON document against a JSON Schema or MongoDB $jsonSchema. Get clear, path-precise errors for missing fields, wrong types, patterns, ranges, and disallowed properties.

JSON Schema Builder

Build a JSON Schema or MongoDB $jsonSchema validator visually — add properties, pick types, mark required, set patterns and ranges — with live output and a test document.

SQL Performance Analyzer

Paste a SQL query to find performance anti-patterns — SELECT *, leading-wildcard LIKE, missing WHERE, cross joins, NOT IN, functions on columns — with a score and ranked fixes.

Redis CLI Simulator

Practice Redis commands in an in-browser terminal. Run GET, SET, HSET, LPUSH, SADD, ZADD, EXPIRE, KEYS and more against a local store — no Redis server required.