SQL Injection · passage 18 of 186

Second Order SQL Injection

Text · SQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Second Order SQL Injection is a subtype of SQL injection where the malicious SQL payload is primarily stored in the application's database and later executed by a different functionality of the same application. Unlike first-order SQLi, the injection doesn't happen right away. It is **triggered in a separate step**, often in a different part of the application. 1. User submits input that is stored (e.g., during registration or profile update).

   Username: attacker'--
   Email: attacker@example.com

2. That input is saved **without validation** but doesn't trigger a SQL injection.

   INSERT INTO users (username, email) VALUES ('attacker\'--', 'attacker@example.com');

3. Later, the application retrieves and uses the stored data in a SQL query.

   query = "SELECT * FROM logs WHERE username = '" + user_from_db + "'"

4. If this query is built unsafely, the injection is triggered.

Every one of the 186 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.