SQL Injection · passage 8 of 186

UNION Based Injection

3 code blocks · SQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

In a standard SQL query, data is retrieved from one table. The `UNION` operator allows multiple `SELECT` statements to be combined. If an application is vulnerable to SQL injection, an attacker can inject a crafted SQL query that appends a `UNION` statement to the original query. Let's assume a vulnerable web application retrieves product details based on a product ID from a database:

SELECT product_name, product_price FROM products WHERE product_id = 'input_id';

An attacker could modify the `input_id` to include the data from another table like `users`.

1' UNION SELECT username, password FROM users --

After submitting our payload, the query become the following SQL:

SELECT product_name, product_price FROM products WHERE product_id = '1' UNION SELECT username, password FROM users --';

:warning: The 2 SELECT clauses must have the same number of columns.

Every one of the 186 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.