# PostSwigger SQL Injection Lab Walkthrough

**Introduction**

SQL Injection (SQLI) is a critical vulnerability that allows attackers to manipulate database queries. In this blog, we will explore an SQL injection attack on a product filtering system where the WHERE clause is vulnerable.

**Understanding the Vulnerability**

Consider the following SQL query used by the application when filtering products by category:

<mark>SELECT * FROM products WHERE category = 'Gifts' AND released =1;</mark>

Here, the application fetches products from the “Gifts” category that have been released (released =1). However, if user input is not properly sanitized, an attacker can manipulate the query.

**Exploiting the Vulnerability**

To retrieve hidden (unreleased) products, an attacker can inject a condition that always evaluates to TRUE.

### ‘ OR 1=1 --

When inserted into the query, it becomes:

<mark>SELECT * FROM products WHERE category = ‘ ‘ OR 1=1 -- ‘ AND released ;</mark>

`.` ‘ OR 1=1 -- teminates the existing condition and forces the query to return **all** products, including unreleased ones.

`.` -- is a common in SQL, which ignores the remaining part of the query.

**Steps to Perform the Attack**

1. Identify an input field where SQL injection is possible.
    
2. Inject the payload (‘ OR 1=1 --) into the category field.
    
3. Submit the request and observe if unreleased products appear.
    

Before applying payload it shows only 3 categories.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741339087949/b2ffcef4-5806-42ab-a1ad-95ba09bb156c.png align="center")

Replace the accessories with SQL payload:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741339427613/af800dbc-44f2-4928-ad3e-9c48e378b41d.png align="center")

After replacing, it showing the hidden categories.

**Mitigation Strategies**

To prevent SQL injection:

1. Use **prepared statements** and **parameterized queries**.
    
2. Implement **input validation** and allowlist filtering.
    
3. Use **least privilege** principles for database access.
    

**Conclusion**

SQL Injection remains a major security threat. By understanding hoe these vulnerabilities work and implementing best practices, developers can secure their applications effectively.