SQL Injection

2.

SQL Fundamentals for Security Testing

2.1.

Basic SQL Structure

2.1.1.

Statement Syntax

2.1.2.

Query Components

2.1.3.

Command Categories

2.2.

Data Manipulation Language

2.2.1.

SELECT Statements

2.2.1.1.

Basic Retrieval

2.2.1.2.

Column Selection

2.2.1.3.

2.2.1.4.

2.2.2.

INSERT Operations

2.2.2.1.

Single Row Insertion

2.2.2.2.

Multiple Row Insertion

2.2.2.3.

Data Source Insertion

2.2.3.

UPDATE Operations

2.2.3.1.

Single Record Updates

2.2.3.2.

2.2.3.3.

Conditional Updates

2.2.4.

DELETE Operations

2.2.4.1.

Single Record Deletion

2.2.4.2.

2.2.4.3.

Cascading Deletes

2.3.

Data Definition Language

2.3.1.

CREATE Statements

2.3.1.1.

2.3.1.2.

Database Creation

2.3.1.3.

2.3.2.

ALTER Statements

2.3.2.1.

Table Structure Modification

2.3.2.2.

Column Addition and Removal

2.3.2.3.

Constraint Management

2.3.3.

DROP Statements

2.3.3.1.

2.3.3.2.

Database Deletion

2.3.3.3.

2.4.

Essential SQL Clauses

2.4.1.

2.4.1.1.

Condition Specification

2.4.1.2.

Logical Operators

2.4.1.3.

Comparison Operators

2.4.1.4.

Pattern Matching

2.4.2.

UNION Operations

2.4.2.1.

Result Set Combination

2.4.2.2.

Column Count Requirements

2.4.2.3.

Data Type Compatibility

2.4.2.4.

UNION vs UNION ALL

2.4.3.

ORDER BY Clause

2.4.3.1.

2.4.3.2.

Multiple Column Sorting

2.4.3.3.

Ascending and Descending Order

2.4.4.

GROUP BY Clause

2.4.4.1.

Data Aggregation

2.4.4.2.

Aggregate Functions

2.4.4.3.

2.5.

SQL Comments and Terminators

2.5.1.

Single-Line Comments

2.5.2.

Multi-Line Comments

2.5.3.

Query Terminators

2.5.4.

Comment Usage in Payloads

2.6.

Database Metadata Access

2.6.1.

Information Schema

2.6.1.1.

Standard Metadata Tables

2.6.1.2.

Schema Discovery Queries

2.6.1.3.

Column Information Retrieval

2.6.2.

System Catalogs

2.6.2.1.

Database-Specific System Tables

2.6.2.2.

Metadata Query Techniques

2.6.2.3.

Permission-Based Access

Previous

1. Introduction to SQL Injection

Go to top

Next

3. SQL Injection Classification