« Previous
Next »
SQLi HOME
Welcome to the iwantcoding.com SQL Injection Tutorial. SQL injection is the oldest still-shipping web vulnerability. The cure is one habit: parameterised queries. This track shows the bug, the cure, and the defence-in-depth around them.
What this tutorial covers
| Chapter | You will learn |
|---|---|
| SQL Injection | How it works, classic, UNION-based, blind, time-based, error-based, second-order, NoSQL injection. |
| Prevention | Parameterised queries, ORMs done right, allow-lists for identifiers, stored procs, least privilege, safe error messages, audit logging. |
| Detection & Hardening | Code review, static analysis, DAST (sqlmap), WAF rules, DB monitoring. |
| Examples | Cheatsheet, runnable snippets, quiz, exercises, bootcamp, certificate. |
Who this is for
- Backend devs touching SQL.
- AppSec engineers training engineering teams.
- Anyone reviewing legacy code (it’s still in there).
How to use this tutorial: read the chapter, run the example with Try it Yourself », do the exercise, then take the quiz at the bottom. Hit Mark complete when you're done — the sidebar will track your progress.
Example
Example
// VULNERABLE — string concatenation
const row = await db.query(
`SELECT * FROM users WHERE email = '${email}'`);
// SAFE — parameterised
const row = await db.query(
'SELECT * FROM users WHERE email = ?', [email]);
Try it Yourself »
« Previous
Next »
Discussion
Loading…