SQL Injection Vulnerability Detector

Project Overview

The SQL Injection Vulnerability Detector is an automated security testing tool developed in Python. The script simulates basic error-based SQL injection (SQLi) attacks by appending an escape string and logical operators to a target URL parameter, parsing the web server's response to check if input validation controls are absent on the backend.

By evaluating HTTP response bodies for specific database error strings, this script highlights vulnerable application entry points, assisting developers in identifying parameter tampering risks before malicious actors can exploit them to compromise database records.

Technical Architecture & Probing Logic

The script programmatically targets web inputs to check for unescaped query execution patterns using a standard pipeline:

Key Engineering Principles

• Automated Parameter Tampering: The tool isolates vulnerable query endpoints by programmatically appending a classic test string (=1' or '1' = '1'). This input breaks vulnerable backend SQL string literals, forcing database parsers to trigger errors.
• Error-Based Analysis: It reads and decodes the UTF-8 HTML response body, searching for standard database debugger outputs (such as "You have an error in your SQL syntax"). If found, it proves that user input is being concatenated directly into raw database queries without sanitization.
• Minimalist Automation: Leveraging Python's urllib libraries, the tool provides a rapid, lightweight audit interface that operates completely independent of heavy browser engines or external scanner frameworks.

Key Python Implementation

Below is the core logic engine showing how the script structures the HTTP payload delivery and evaluates backend database stability:

# Appending payload, executing request, and inspecting body for SQL errors
fullurl = raw_input("Please insert the url of the target website: ")

# Construct payload-appended URL request
resp = urllib.request.urlopen(fullurl + "=1\' or \'1\' = \'1\'")
body = resp.read()
fullbody = body.decode('utf-8')

# Evaluate server response for dynamic database errors
if "You have an error in your SQL syntax" in fullbody:
    print ("The Website is SQL injection vulnerable")
else:
    print ("The Website is not SQL injection vulnerable")

Defensive Hardening & SQLi Remediation

SQL injection remains one of the most severe web-layer risks. To secure database backends against input tampering, developers should enforce these secure coding standards:

• Use Prepared Statements (Parameterized Queries): Ensure that application SQL queries use pre-compiled, parameterized inputs. By separating user-supplied parameters from query logic, database systems treat input strictly as literal values rather than executable code.
• Implement Strong Input Sanitization & Whitelisting: Validate all incoming parameters against restrictive regular expressions, strictly permitting expected types (such as forcing IDs to be integer types only) before processing queries.
• Follow the Principle of Least Privilege: Configure database user accounts to only possess permissions strictly required for execution (such as removing schema altering or system access rights from web interfaces).