Stage 7 beginner
SQL Injection
Follow the shop's search into a database, find where input changes a command, then check a safer version.
Runs in your browser. Nothing to install — the lesson and a real Linux computer open side by side.
Start Stage 7 → Get Chapter 2 · $24 →One payment unlocks all four stages: Logins and Sessions, IDOR, SQL injection and XSS. Yours to keep, no subscription.
Already bought it? Sign in
Lesson steps
- Welcome to the sister shop
- Ask a table a question
- Behind the shop’s search
- When a quote ends the value
- Change which rows match
- A password check disappears
- Join two sets of rows
- Another table in the search results
- Find a table you weren’t told about
- A value stays a value
- Final challenge: sign off the fix
- Stage complete
What this stage is
The bakery has opened a gift shop. Its products and accounts live in a database: tables of information that the website can look up. You'll start with your own practice tables and learn SQL, the language used to ask them questions.
Next, follow an ordinary product search from a web request to a database lookup. The weak shop mixes customer input into its commands, and each exploit leads to the next: an unlisted product points to an account, the account points to a reserve, and the reserve points to a hidden audit table you discover through the schema. You'll explore what goes wrong inside the lab, then compare a fixed copy.
Why it matters
A search term should stay a search term. If a site lets it change a database command, it may return private information or skip a check. This mistake is called SQL injection.
The fix keeps the command and its input separate. You'll practise that idea yourself and check that names with apostrophes still work. Blocking every search would break the shop too.
By the end you'll be able to
- read tables, choose columns, filter rows and combine results
- trace how a search or sign-in form uses a database
- recognize when customer input changes what a lookup does
- keep input separate from a command using bound values
- check that private data stays private and ordinary search and login still work
Ten flag challenges take you from your first SELECT to testing the fix. You'll read flag codes from a practice database and from the shop's products, then follow a trail through the shop: an unlisted product points to an account, the account points to a reserve, and the reserve points to a hidden audit table you discover through the schema. The final challenge is to sign off the fix. The shop records seven checks and releases a flag only when the unsafe cases fail safely and normal customer actions succeed.
Learn more (external)
- PortSwigger — SQL injection — The best free SQLi walkthrough, with labs.
- OWASP — SQL Injection
- OWASP — SQL Injection Prevention Cheat Sheet
- SQLite — sqlite_master schema table