How SQL injection exploits queries - Visual Walkthrough

Concept Flow - How SQL injection exploits queries

User Input Received

↓

Input Inserted into SQL Query

↓

Query Sent to Database

↓

Database Executes Query

↓

If Input is Malicious

Yes↓

SQL Injection Occurs

↓

Attacker Gains Unauthorized Access

↓

END

No↓

Query Executes Normally

↓

END

User input is added to a SQL query. If input is malicious, it changes query meaning, causing SQL injection and unauthorized access.

Execution Sample

SQL

user_input = "' OR '1'='1";
query = "SELECT * FROM users WHERE username = '" + user_input + "';";
-- Query sent to DB
-- DB executes query

This code shows how a malicious input changes a SQL query to always return true, causing SQL injection.

Execution Table

Step	User Input	Query Formed	Query Meaning	Result
1	' OR '1'='1	SELECT * FROM users WHERE username = '' OR '1'='1';	Returns all users because '1'='1' is always true	All user records returned (SQL Injection)
2	normalUser	SELECT * FROM users WHERE username = 'normalUser';	Returns user with username 'normalUser'	Only normalUser record returned
3	admin'; --	SELECT * FROM users WHERE username = 'admin'; --	Comments out rest, returns admin user	Admin user record returned (SQL Injection)
4		SELECT * FROM users WHERE username = '';	Returns no user (empty username)	No records returned
5	user123	SELECT * FROM users WHERE username = 'user123';	Returns user with username 'user123'	User123 record returned
6				Execution ends

💡 Execution stops after query is sent and database returns results.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	Final
user_input	null	' OR '1'='1	normalUser	admin'; --		user123	user123
query	null	SELECT * FROM users WHERE username = '' OR '1'='1';	SELECT * FROM users WHERE username = 'normalUser';	SELECT * FROM users WHERE username = 'admin'; --	SELECT * FROM users WHERE username = '';	SELECT * FROM users WHERE username = 'user123';	SELECT * FROM users WHERE username = 'user123';

Key Moments - 3 Insights

Why does the query return all users when input is "' OR '1'='1"?

Because the input closes the username string and adds OR '1'='1', which is always true, so the WHERE clause matches all rows (see execution_table step 1).

How does the input "admin'; --" change the query?

It closes the username string and adds a comment marker -- which ignores the rest of the query, effectively returning the admin user (see execution_table step 3).

Why does an empty input return no records?

Because the query becomes WHERE username = '', which matches no user (see execution_table step 4).

Visual Quiz - 3 Questions

Look at the execution_table at step 1, what does the query return?

A No records

B All user records

C Only admin user

D Syntax error

💡 Hint

Check the 'Result' column at step 1 in execution_table.

At which step does the input use SQL comment to change the query?

A Step 3

B Step 2

C Step 4

D Step 5

💡 Hint

Look for input containing '--' in execution_table.

If user_input is empty, what is the query result?

A Returns all users

B Returns admin user

C Returns no users

D Causes error

💡 Hint

See execution_table step 4 for empty input.

Concept Snapshot

SQL injection happens when user input is added directly to a query.
Malicious input can change query logic.
Example: input "' OR '1'='1" makes WHERE always true.
This returns all rows, bypassing security.
Always use parameterized queries to prevent injection.

Full Transcript

This visual execution shows how SQL injection exploits queries by inserting malicious user input. The input is added directly into the SQL query string. For example, input like "' OR '1'='1" changes the WHERE clause to always be true, returning all user records. Another input "admin'; --" uses SQL comment to ignore the rest of the query and return the admin user. Empty input returns no records. The execution table traces each step showing user input, formed query, meaning, and result. Variable tracker shows how user_input and query change each step. Key moments explain why certain inputs cause injection. The quiz tests understanding of these steps. The snapshot reminds to use parameterized queries to avoid this risk.