SQL Injection · passage 4 of 186

DBMS Identification Error Based

Text · SQL Injection/README.md

Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Different DBMSs return distinct error messages when they encounter issues. By triggering errors and examining the specific messages sent back by the database, you can often identify the type of DBMS the website is using. | DBMS | Example Error Message | Example Payload | | -------------------- | ----------------------------------------------------------------------------------------- | --------------- | | MySQL | `You have an error in your SQL syntax; ... near '' at line 1` | `'` | | PostgreSQL | `ERROR: unterminated quoted string at or near "'"` | `'` | | PostgreSQL | `ERROR: syntax error at or near "1"` | `1'` | | Microsoft SQL Server | `Unclosed quotation mark after the character string ''.` | `'` | | Microsoft SQL Server | `Incorrect syntax near ''.` | `'` | | Microsoft SQL Server | `The conversion of the varchar value to data type int resulted in an out-of-range value.` | `1'` | | Oracle | `ORA-00933: SQL command not properly ended` | `'` | | Oracle | `ORA-01756: quoted string not properly terminated` | `'` | | Oracle | `ORA-00923: FROM keyword not found where expected` | `1'` |

Every one of the 186 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.