Skip to content
BackEsc
Sign in

SQL Injection · passage 26 of 186

Case Modification

Text · SQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

Bypass using uppercase/lowercase. | Bypass | Technique | | ------ | ---------- | | `AND` | Uppercase | | `and` | Lowercase | | `aNd` | Mixed case | Bypass using keywords case insensitive or an equivalent operator. | Forbidden | Bypass | | --------- | --------------------------- | | `AND` | `&&` | | `OR` | `\|\|` | | `=` | `LIKE`, `REGEXP`, `BETWEEN` | | `>` | `NOT BETWEEN 0 AND X` | | `WHERE` | `HAVING` |

Source: SQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 1 to 26, reading order first.

  1. SQL Injection§ 1text · README.md
  2. Entry Point Detection§ 2text · README.md
  3. DBMS Identification Keyword Based§ 3text · README.md
  4. DBMS Identification Error Based§ 4text · README.md
  5. Authentication Bypass§ 54 code blocks · README.md
  6. Raw MD5 and SHA1§ 62 code blocks · README.md
  7. Hashed Passwords§ 71 code block · README.md
  8. UNION Based Injection§ 83 code blocks · README.md
  9. Error Based Injection§ 92 code blocks · README.md
  10. Blind Injection§ 10text · README.md
  11. Boolean Based Injection§ 113 code blocks · README.md
  12. Blind Error Based Injection§ 121 code block · README.md
  13. Time Based Injection§ 133 code blocks · README.md
  14. Out of Band (OAST)§ 14text · README.md
  15. Stacked Based Injection§ 151 code block · README.md
  16. Polyglot Injection§ 161 code block · README.md
  17. Routed Injection§ 172 code blocks · README.md
  18. Second Order SQL Injection§ 18text · README.md
  19. PDO Prepared Statements§ 19text · README.md
  20. Generic WAF Bypass§ 20text · README.md
  21. No Space Allowed§ 21text · README.md
  22. Alternative Whitespace Characters§ 22text · README.md
  23. Bypassing with Comments and Parentheses§ 23text · README.md
  24. No Comma Allowed§ 24text · README.md
  25. No Equal Allowed§ 25text · README.md
  26. Case Modification§ 26text · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in