Web › Module 1 › Lesson 2
SQL Injection Types
Union-based, error-based, and in-band techniques that leak data through normal responses
Visual · web_developer
Not every SQLi looks like a login bypass. Attackers adapt to what the app returns—errors, extra rows, or silent failures.
Opening
Same flaw, different shapes
Once input reaches SQL unsafely, attackers choose a technique based on what they can see in the HTTP response. Some apps spill database errors. Others happily render extra query results. Knowing the types helps you test systematically and defend with the same mindset.
1. In-Band SQLi (Classic)
In-band SQL injection means the attacker uses the same channel to inject and retrieve results—usually the web page itself. Two common flavors appear constantly in labs and real assessments.
2. Union-Based Injection
UNION combines the attacker's SELECT with the original query so extra columns appear in the page—user emails, password hashes, admin flags. The attacker must match the number and compatible types of columns in the original query.
Conceptual UNION payload (lab only)
3. Error-Based Injection
When verbose database errors reach the browser, attackers craft input that forces the DB to echo secrets inside the error message—table names, column names, or even extracted data via functions like extractvalue() on MySQL.
Error-based probe (authorized lab)