Lab · Beginner · 15 min Solved
SQL injection (fake login)
Learn how a login built with string glue can be tricked. All data is fake and stays in your browser.
1) The idea
The app builds a SQL query by sticking your text into a sentence. If your text closes the quote early, you can change the meaning of the question the database asks.
2) Try it
Open the login box. Try a username like ' OR '1'='1 with any password. Watch the query line update.
Hint 1
You need the part after the username quote to become always-true.
Hint 2
A classic pattern is: ' OR '1'='1
3) The fix
Never build SQL with string + user input. Use parameterized queries / prepared statements. Validate and least-privilege the DB user. Add tests that send quotes and operators.
Simulated tools. They can only act on this lab's fake target inside the sandbox — there is no target field, no network, and nothing leaves your browser.
Auto SQL injectorSends quote/tautology probes to the fake login and spots the bypass.
$ sqli-sim --auto
Recon (headers & forms)Lists the fake target's simulated headers and input fields.
$ recon-sim
Real scanners against real sites without permission are illegal. Use these ideas only on systems you own or are authorized to test.