← back to sql injection

sql.injection.lab

basic string concatenation vulnerability

Target: Secure Bank Login

Query Construction

-- Vulnerable SQL Query
SELECT * FROM users
WHERE email = '(input)'
AND password = '(input)'
User input is directly concatenated into the SQL string

Executed Query

No query executed yet

Database Response

No database response yet
No application logs yet

This is a controlled environment for educational purposes.

Real applications should use parameterized queries to prevent SQL injection.