Project
SQL Injection Demo
A simple browser demo that shows how SQL injection changes a query, why that is dangerous, and how safer queries block it. Nothing here uses a real database.
What you will see
Your input is placed into a fake query so you can see how a login or search can be changed.
Why it happens
The problem starts when an app builds SQL from raw text instead of treating user input like plain data.
How to block it
Prepared statements keep the query structure fixed, so user input cannot turn into part of the SQL command.
Secure mode treats what you type like data, not SQL.
Member Login
This box acts like a weak login form.
This example shows how a search box can be abused to pull rows from a different table. It is only a browser simulation, but it shows the same idea behind a UNION-based data leak.
Secure mode keeps the search term as plain data.
Product search
Type a normal search or use one of the sample payloads.
The main fix is simple: do not build SQL by joining strings together. Send the query and the values separately so the database never treats input like code.
Bad: raw string building
query = (
"SELECT * FROM users "
"WHERE username = '" + username + "' "
"AND password = '" + password + "'"
)
cursor.execute(query)Good: parameterized query
query = (
"SELECT * FROM users "
"WHERE username = %s "
"AND password = %s"
)
cursor.execute(query, (username, password))Check input
Look for the format you expect before anything reaches the database layer.
Limit access
The app account should only have the database permissions it really needs.
Hide raw errors
Do not show database errors to users because those messages can reveal useful details.
Everything here runs in JavaScript with fake in-memory data. There is no backend, no real SQL server, and no network request, so it is safe to host as a public demo.
How It Was Made
This project was built as a browser-only demo so the attack flow could be shown safely. The page uses plain HTML, CSS, and JavaScript to copy how a weak app might behave, then compares that with a safer query pattern.