{"id":445,"date":"2026-10-14T10:51:12","date_gmt":"2026-10-14T10:51:12","guid":{"rendered":"http:\/\/www.scmgalaxy.com\/tutorials\/2015\/10\/22\/sqj-injection\/"},"modified":"2026-10-14T10:51:12","modified_gmt":"2026-10-14T10:51:12","slug":"sqj-injection","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/sqj-injection\/","title":{"rendered":"Authorized SQL Injection Testing: Blind, Error-Based, and Tautology Checks"},"content":{"rendered":"\n

Originally published on 2015-10-22; fully revised and updated.<\/em><\/p>\n\n\n\n

SQL injection testing helps security engineers, developers, and DevOps teams detect input paths that can alter backend SQL behavior. This guide covers three foundational testing methods from the original post (blind, error-based, and tautology-based), how to interpret the results, and how to move from detection to remediation.<\/p>\n\n\n\n

Important:<\/strong> run these checks only on systems you own or are explicitly authorized to test.<\/p>\n\n\n

\n
\"sql-injection\"<\/figure>\n<\/div>\n\n\n

Three SQL injection testing methodologies<\/h2>\n\n\n\n

The original article identifies three common techniques. Each one gives a different type of signal, so using them together usually gives better confidence than relying on a single test.<\/p>\n\n\n\n

Method<\/th>Example input pattern<\/th>Typical signal<\/th>What to watch for<\/th><\/tr><\/thead>
Blind (time-based)<\/td>id=sleep(30)<\/code><\/td>Response delay<\/td>Latency can also come from network or backend load<\/td><\/tr>
Error-message based<\/td>id='"<\/code><\/td>Database syntax error in response<\/td>Production systems may hide errors<\/td><\/tr>
Tautology-based<\/td>username=' or 1=1 \/*<\/code><\/td>Unexpected authentication\/query behavior<\/td>Input filters and parameterized queries may block it<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Blind (time-based) checks<\/h3>\n\n\n\n

In MySQL-oriented examples, a sleep function can indicate injection when request timing changes predictably.<\/p>\n\n\n

time curl -s -o \/dev\/null<\/span> \"http:\/\/localhost\/test.php?id=sleep(30)\"<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
If the delay consistently appears only when the payload is present, that is a stronger indicator than a single slow request.<\/p>\n\n\n\n
Error-message checks<\/h3>\n\n\n\n
Malformed input may trigger SQL parser errors when error reporting is exposed.<\/p>\n\n\n
curl -i \"http:\/\/localhost\/test.php?id=%27%22\"<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
A response containing SQL syntax details can confirm that unsanitized input reached query construction.<\/p>\n\n\n\n
Tautology-based checks<\/h3>\n\n\n\n
Tautology payloads try to make a WHERE clause always true. In authentication contexts, this can produce unauthorized behavior if input is concatenated directly into SQL.<\/p>\n\n\n
curl -i \"http:\/\/localhost\/test.php?username=%27%20or%201%3D1%20%2F*&password=1\"<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
SQL injection testing workflow (authorized assessment)<\/h2>\n\n\n\n
\nflowchart TD\n    A[Define authorized scope] --> B[Record baseline behavior]\n    B --> C[Run manual payload checks]\n    C --> D{Suspicious behavior seen}\n    D -- No --> E[Run automated scanner]\n    D -- Yes --> F[Retest for consistency]\n    E --> G[Collect evidence]\n    F --> G\n    G --> H[Implement fix]\n    H --> I[Retest and close finding]\n<\/pre>\n\n\n\n
Manual testing vs automated scanning<\/h2>\n\n\n\n
The original post mentions free\/open source tools such as Wapiti and Skipfish. Manual checks and scanners are complementary: manual payloads provide precision, while scanners provide broader coverage.<\/p>\n\n\n\n
Approach<\/th>Best for<\/th>Strength<\/th>Limitation<\/th><\/tr><\/thead>
Manual payload testing<\/td>Validating a specific endpoint<\/td>High control and context awareness<\/td>Limited coverage at scale<\/td><\/tr>
Wapiti<\/td>Automated web vulnerability crawling\/testing<\/td>Broader discovery across routes<\/td>Requires tuning and result triage<\/td><\/tr>
Skipfish<\/td>High-speed web application reconnaissance\/testing<\/td>Fast large-surface probing<\/td>Can generate noisy findings<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n
# Example invocations (verify flags for your installed version)<\/span>\nwapiti -u \"http:\/\/localhost\/\"<\/span>\nskipfish -o .\/skipfish-report \"http:\/\/localhost\/\"<\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Common pitfalls when validating findings<\/h2>\n\n\n\n