How to use the SQL Injection Learning Lab
- 1. Pick a levelLog in as admin, reveal hidden courses, or exploit a numeric ID.
- 2. Type input and watch the queryThe SQL the app would send updates as you type, so you can see exactly how your input changes it.
- 3. Run, then fixRun the query on the practice database, then tick 'parameterised query' and see the same input fail.
How SQL injection happens
Many apps build SQL by pasting user input into a string, such as WHERE email = ' + email + '. If the input contains a quote, it ends the string early, and whatever follows becomes part of the SQL. A comment marker (--) then hides the rest of the original query. That's how a login can be bypassed, or hidden data revealed. The lab runs your input against a real SQLite database (via sql.js) that lives only in your browser and is rebuilt for every attempt, so you can experiment freely, even with DROP TABLE. Use these skills only in labs like this one, or on systems you own or have written permission to test; attacking real websites is a crime under India's IT Act.
The fix is the same everywhere: parameterised queries (prepared statements). The SQL and the values travel separately, so a quote in the input is just a character. The lab shows the fix in Python, Node.js, Java and PHP.
Worked example
Level 1's query is SELECT id, email, role FROM users WHERE email = '…' AND password = '…'. Entering the email admin@college.test'-- with any password turns it into … WHERE email = 'admin@college.test'--' AND password = 'x'; everything after -- is a comment, so the password is never checked and the admin row comes back. Tick Use a parameterised query and the same input returns 0 rows. We checked that each level's hint input solves it on the real database, and that the parameterised version blocks all three.
What to remember
- Escaping quotes by hand is fragile; use your driver's placeholders (
?,%sor$1). - ORMs are safe by default, but raw queries inside them aren't.
- Give the app's database user only the permissions it needs, so a bug can't drop tables.
Frequently asked questions
Is this real hacking?
It's a real technique on a practice database that exists only in your browser. Nothing is sent to any server.
Do I need to know SQL?
Basic SELECT and WHERE help. The lab shows the full query at every step, so you can follow along.
Is the SQL injection lab free?
Yes. You can open the SQL injection lab and try everything without signing up. When you run a query for the first time, we ask once for your name and WhatsApp number; after that it, and every other Uncodemy tool, opens straight away.