SQL injection test payload list

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Pass user input as a parameter, never by building the SQL string. Every payload is then stored as plain text, and the DROP TABLE line drops nothing.

import sqlite3

db = sqlite3.connect(":memory:")
db.execute("CREATE TABLE users (name TEXT)")
with open("sql-injection-payloads.txt", encoding="utf-8") as f:
    payloads = [line.rstrip("\n") for line in f if line.strip()]
for p in payloads:
    db.execute("INSERT INTO users (name) VALUES (?)", (p,))  # a parameter, not string formatting
stored = [row[0] for row in db.execute("SELECT name FROM users")]
print(f"{len(payloads)} payloads stored verbatim: {stored == payloads}")
print("tables:", [row[0] for row in db.execute("SELECT name FROM sqlite_master WHERE type = 'table'")])

Run against this file, it prints: 10 payloads stored verbatim: True tables: ['users']