SQL Injection - Hunter Knowledge Base

SQLi happens when attacker-controlled input is placed into a SQL statement as code rather than data - typically string concatenation/interpolation into a query instead of a bound parameter.

When to hunt this

• Any code that builds SQL from variables: string concatenation, f-strings/template literals, %/+/.format.
• ORM "raw" escape hatches even when the ORM normally parameterizes.
• Dynamic query pieces attackers rarely expect to be bound: table/column names, ORDER BY, LIMIT, IN (...) lists, LIKE patterns.
• Reachability first: prioritize sinks reachable from an entry point in codebase-map.json.

Sources (untrusted input)

Request params/body/query/headers/cookies, path segments, uploaded content, values from other services, and anything from the entry-point inventory. Also "stored" sources: DB/file values that were themselves attacker-influenced (second-order SQLi).

Sinks by ecosystem (grep targets)

• Python: cursor.execute(, cursor.executemany(, .execute( on a DB conn; SQLAlchemy text(, .from_statement(, session.execute(, engine.execute(; Django .raw(, .extra(, RawSQL(, connection.cursor(). Danger sign: a %, +, f"...", or .format( inside the SQL string.
• JS/TS: db.query(, connection.query(, pool.query(, sequelize.query(, knex.raw(, .$queryRawUnsafe( (Prisma), client.query(. Template literals with ${...} inside SQL.
• Java: Statement.execute*(, createStatement() then executeQuery(concat), JPA createQuery/createNativeQuery with string concat, MyBatis ${} (vs safe #{}).
• PHP: mysqli_query(, $pdo->query(, ->exec( with concatenation; mysql_query(.
• Go: db.Query(/db.Exec(/QueryRow( where the query string is built with fmt.Sprintf/+.
• Ruby: where("... #{}"), find_by_sql(, exec_query(, .where(user_str).
• .NET: SqlCommand(concat), ExecuteReader with interpolated string; EF FromSqlRaw(.

Detection recipe (see references/graft-guide.md)

1. graft grep "execute\(|\.query\(|raw\(|createNativeQuery|FromSqlRaw" --json (or Grep).
2. For each hit, inspect the query argument: is it a bound-parameter call (safe) or string building (suspect)? Grep the same lines for %|\+|\$\{|f\"|\.format\(|#\{|Sprintf|concat.
3. graft callers <enclosing-fn> to reach an entry point; record the data_flow[] source->sink.
4. Confirm no whitelist/cast/parameterization intervenes.

Payloads / PoC templates (curated)

• Detection: ' , '' , 1' OR '1'='1 , 1) OR (1=1 , admin'-- , " OR ""=".
• Boolean-blind: 1 AND 1=1 vs 1 AND 1=2 (differing responses).
• Time-blind: 1; WAITFOR DELAY '0:0:5'-- (MSSQL), 1 AND SLEEP(5) (MySQL), 1; SELECT pg_sleep(5)-- (PG).
• UNION: 1 UNION SELECT NULL,version(),NULL-- (adjust column count/types).
• Error-based: 1 AND extractvalue(1,concat(0x7e,version())) (MySQL).
• Second-order: store x'-- via one endpoint, trigger the vulnerable query via another. See references/cheatsheet.md for per-DB detail and ORDER BY/LIKE/IN injection variants.

False-positive filters (do NOT flag)

• Fully parameterized queries: execute("... WHERE id = %s", [id]), ?/:name placeholders, Prisma $queryRaw tagged template (safe) vs $queryRawUnsafe (unsafe), MyBatis #{} (safe).
• The interpolated value is a constant/enum/int-cast the attacker cannot control, or is validated against an allowlist (e.g. sort column checked against a fixed set).
• ORM query builders (.filter(User.id==id), .where({id})) that bind under the hood.
• Identifiers quoted via a proper quoting API (e.g. psycopg2.sql.Identifier).

CWE / OWASP / severity

• CWE-89 (SQLi), CWE-943 (NoSQL/query injection). OWASP A03:2021-Injection.
• Severity: usually critical if unauthenticated and dumps/modifies data; high if authenticated or limited. Blind-only with narrow impact may be high/medium.

Chaining hints

• SQLi -> read credential/secret tables -> auth bypass / account takeover.
• SQLi write -> stored XSS or config poisoning.
• SQLi -> read files (LOAD_FILE, COPY ... FROM PROGRAM) -> RCE on some DBs; -> SSRF via DB features.
• Feeds chains with secrets, auth, access-control.

Mitigation (put a specific one on each finding)

Use parameterized queries / prepared statements for values; for identifiers use an allowlist or the driver's identifier-quoting API; least-privilege DB accounts; ORM safe APIs. Never concatenate input into SQL.