For educational purposes only

Learn SQL injection hands-on

An interactive lab where you attack a real SQLite database running entirely in your browser. No server, no risk — just you and the database.

How it works

Safe, hands-on, and always available

Real database in the browser

Every task runs against an actual SQLite database via WebAssembly. Your injections truly execute — safely sandboxed in your browser.

Progressive tasks

From the basics to advanced techniques: union-based, error-based, tautologies, piggy-backed queries and more.

Progress tracking

Every attempt and result is saved to your account. Run multiple sessions and follow your progress.

Custom task sets

Import your own tasks as JSON and upload your own SQLite database. Build your own exercises.

A taste of what's inside

Union-based injection

Append results from other tables to the output and exfiltrate sensitive data such as user passwords.

Tautologies

Bypass authentication with an always-true expression, for example ' OR '1'='1.

Error-based injection

Trigger error messages that leak the structure of the database.