⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION
SQLi
SQL Injection
Login and search forms with string-concatenated queries. No parameterization, no prepared statements.
> Show hints
- [1] Login bypass: username = admin'-- (comments out password check)
- [2] Login bypass: username = ' OR '1'='1' --, password = anything
- [3] Search UNION: ' UNION SELECT * FROM users--
[1] Login Form
Credentials interpolated directly into the SQL query string.
[2] Product Search
Search term injected into a LIKE query. UNION-based extraction possible.