Easy
PawMatch breed search UNION injection
A pet-adoption directory. The breed filter concatenates straight into the query.
1 solve
SQL Injection
Untrusted input concatenated straight into a query, letting an attacker change what the query does.
What it is
SQL injection happens when untrusted input is concatenated into a SQL statement instead of passed as a bound parameter, letting an attacker change the query's structure, not just its data.
How it works
$sql = "SELECT * FROM pets WHERE breed = '" . $_GET['breed'] . "'"; $results = $db->query($sql);
An attacker submitting ' UNION SELECT username, password FROM users --
turns one query into two, extracting data the page was never meant to show.
Real-world impact
Full database read (credentials, PII, payment data), and depending on the database engine and permissions, write access or even command execution. Because a single injection point often reaches the whole schema, SQLi findings are consistently rated critical.
How to prevent it
$stmt = $db->prepare("SELECT * FROM pets WHERE breed = ?"); $stmt->execute([$_GET['breed']]);
Parameterised queries (prepared statements) everywhere: string concatenation into SQL is never safe, whatever escaping is applied first.
Labs in this topic
Medium
CraftBrew Loyalty sort-order blind injection
A taproom rewards tracker. The sort option reaches ORDER BY unescaped, so UNION won't work here.
0 solves
Hard
Aegis Claims legacy API filter bypass
An insurance claims-status portal. The modern search is safe; an old partner API keyword-filters instead.
0 solves