SQL Injection

The bug

SQL injection happens when user input is concatenated straight into a query:

query = "SELECT * FROM users WHERE name = '" + name + "'"

Supply name = ' OR '1'='1 and the WHERE clause is always true.

Authentication bypass

The canonical CTF payload in a login form:

username: admin' --
password: anything

The -- comments out the password check, logging you in as admin.

Extracting data with UNION

When output is reflected, UNION SELECT lets you pull from other tables:

' UNION SELECT username, password FROM users -- -

Match the column count first (ORDER BY 1,2,3... until it errors).

Automating with sqlmap

Once you have found an injectable parameter, let a tool grind:

sqlmap -r request.txt --batch --dump

Defense (so you recognize safe code)

Parameterized queries / prepared statements make injection impossible — if you see ? placeholders bound separately, that parameter is not your way in.