SQL Injection Detector
Scan SQL queries or application code for injection-prone patterns — unsafe string concatenation, template-literal and f-string interpolation, classic payloads like OR 1=1 and UNION SELECT — then learn the parameterized-query fix for Node.js, Python, PHP, and Java. Defensive and educational; everything runs locally in your browser.
About this ToolHow it works, benefits & use casesTap to collapse
Paste a SQL query or the application code that builds one, and this scanner flags injection-prone patterns line by line. It catches the root cause - unsafe query construction such as string concatenation ("... WHERE name = '" + input), JavaScript template-literal interpolation (`... ${id}`), Python f-strings, and printf/%-style formatting - as well as classic payload signatures like OR 1=1 tautologies, UNION SELECT extraction, stacked queries (; DROP TABLE), comment terminators, time-based probes (SLEEP, BENCHMARK, WAITFOR DELAY), information_schema probing, and server-side file functions. Every finding shows its category, severity (critical, high, medium, or low), the matched snippet, a line and column number, a plain-language explanation, and the exact parameterized fix. You also get side-by-side safe rewrites for Node.js (pg, mysql2), Python (psycopg2, sqlite3), PHP (PDO), and Java (PreparedStatement), plus a copyable report. This is a defensive, educational tool: it analyzes text locally in your browser and never connects to or runs anything against a database.
How to Use
- 1Paste a SQL query or a code snippet that constructs a query into the input panel, or click a preset such as OR 1=1, UNION attack, or Vulnerable Python.
- 2Optionally choose a language in "Show fixes for" to focus the safe-rewrite examples on Node.js, Python, PHP, or Java.
- 3Press "Scan for SQL Injection" (or Cmd/Ctrl+Enter) to analyze the input.
- 4Read the scorecard for the risk score and per-severity counts, then expand each finding to see the matched snippet, its line and column, why it is dangerous, and how to fix it.
- 5Apply the parameterized-query rewrite for your language, then copy or share the plain-text report.
Key Benefits
- Detects the root cause - unsafe query construction in code - not just attack strings
- Recognizes concatenation, template literals, Python f-strings, and printf/% formatting
- Flags classic payloads: OR 1=1, UNION SELECT, stacked queries, comments, time-based probes
- Severity-graded findings with line and column numbers and plain-language explanations
- Side-by-side unsafe vs. safe parameterized examples for Node.js, Python, PHP, and Java
- Copyable, shareable plain-text report for tickets and code reviews
- Defensive and fully in-browser - your code is never uploaded
Common Use Cases
- Reviewing application code during a security pass to find queries built from user input
- Teaching developers why concatenated or interpolated queries are unsafe and how to parameterize them
- Triaging a suspicious value from request logs or a WAF alert before deeper investigation
- Demonstrating the difference between vulnerable and parameterized queries to a team
- Spot-checking a snippet in a pull request before approving it
Paste a query or a code snippet that builds a query. Nothing is uploaded — analysis runs in your browser.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related tools
- XSS DetectorScan input for XSS vectors by category and severity, encode it safely for any context (HTML, attribute, JS, URL, CSS), and browse a payload and sanitization reference
- Unused CSS DetectorFind CSS selectors never matched by your HTML, see how many bytes you can save, and get cleaned CSS - with a safelist for dynamic classes
- User Agent ParserParse and analyze user agent strings
- CORS Header GeneratorGenerate CORS headers for API endpoints
- Security Headers GeneratorGenerate hardened HTTP security headers with a live A+ to F grade, then export to nginx, Apache, Caddy, Vercel, Netlify, Next.js, Express, or Cloudflare; or audit a site's existing headers
- OWASP Security CheckerScan code & HTTP headers for OWASP Top 10 issues plus an interactive checklist
Two things. First, unsafe query construction in source code: string concatenation that builds SQL, JavaScript template-literal interpolation, Python f-strings, and printf/sprintf/%-style formatting that places values into the query text. Second, classic injection signatures in a value or query: OR 1=1 and quoted tautologies, UNION SELECT, stacked queries (a semicolon followed by DROP/DELETE/etc.), comment terminators (-- # /* */), time-based probes (SLEEP, BENCHMARK, PG_SLEEP, WAITFOR DELAY), information_schema / sqlite_master / pg_catalog probing, dynamic-SQL execution sinks, and server-side functions like LOAD_FILE and INTO OUTFILE.
Each finding contributes weighted points by severity - 40 for critical, 25 for high, 12 for medium, 5 for low - and the total is capped at 100. A higher score means more or more severe injection-prone patterns. A clean input scores 0. The score is a triage signal, not a guarantee.