SQL Injection · passage 8 of 186

UNION Based Injection

3 code blocks · SQL Injection/README.md

Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

In a standard SQL query, data is retrieved from one table. The `UNION` operator allows multiple `SELECT` statements to be combined. If an application is vulnerable to SQL injection, an attacker can inject a crafted SQL query that appends a `UNION` statement to the original query. Let's assume a vulnerable web application retrieves product details based on a product ID from a database:

SELECT product_name, product_price FROM products WHERE product_id = 'input_id';

An attacker could modify the `input_id` to include the data from another table like `users`.

1' UNION SELECT username, password FROM users --

After submitting our payload, the query become the following SQL:

SELECT product_name, product_price FROM products WHERE product_id = '1' UNION SELECT username, password FROM users --';

:warning: The 2 SELECT clauses must have the same number of columns.

Every one of the 186 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.