SQL Injection Detector

Injection probes leave fingerprints in web and application logs — UNION SELECT chains, OR 1=1 tautologies, quote-broken conditions like ' OR '1'='1, dead-ends like -- or /*, and timing bombs like sleep(). SQL Injection Detector runs over your log text line by line, uses two levels of URL-decoding to defeat obfuscation, and groups each line under the technique it matches.

Categories cover union-based, boolean-based, time-based, comment-based, stacked-query, metadata-probe, and error-echo injection. A default Normal profile keeps everyday noise down while still catching the classic attack shapes — including quoted tautologies such as ' OR 'a'='a, not just their bare-digit form OR 1=1. A Strict mode widens the net further for raw application logs where you would rather review extra candidates than miss a probe. Results tally per category, name the single highest-risk technique found, and show the exact matched fragment for every flagged line so you never have to take the classification on faith.

Detection works on the decoded text, not the raw bytes, because attackers routinely percent-encode the characters a WAF or naive filter is watching for. A quote becomes %27, a space becomes %20, an equals sign becomes %3D. The tool reverses up to two layers of that encoding before any pattern is tested, so a payload like id=1%2527%2520OR%2520%25271%2527%253D%25271 — doubly encoded to slip past a single-pass decoder — still resolves to the plain tautology and gets flagged under boolean-based injection with the decoded fragment shown as evidence.

• Technique-categorized detection — union, boolean, time, comment, stacked, metadata, and error-echo probes, each scored by risk.
• Quote-aware boolean matching — catches both bare tautologies like OR 1=1 and quote-broken ones like ' OR '1'='1.
• Double URL-decoding — defeats one or two layers of percent-encoding obfuscation before matching.
• Normal and strict profiles — balance recall vs. noise; strict adds a lone-apostrophe heuristic for full-recall audits.
• Per-line matched fragment — see exactly what tripped, not just a yes/no flag.
• Category breakdown and highest-risk indicator — triage at a glance before reading every line.
• Copy / export report — hand the flagged lines straight to a ticket or a security queue.
• Local only — nothing uploaded, no network calls, ever.

1. Paste your logs — access logs, WAF logs, application logs, or a raw request dump.
2. Pick a profile. Normal is tuned for high precision on real attack traffic; Strict adds weaker signals like a lone apostrophe for full-recall audits where noise is acceptable.
3. Run detection. Every non-blank line is decoded, matched against the technique library, and grouped under the categories it triggers.
4. Read the summary cards — lines scanned, flagged count, number of distinct categories hit, and the single highest-risk technique found.
5. Scan the by-technique breakdown to see which attack shapes dominate — a wall of comment-injection hits usually means noisy free text, while union or stacked-query hits deserve immediate attention.
6. Review the flagged-lines report line by line, then copy it to the security queue for triage or blocking.

Example 1 — SQLMap in the access log. Requests carrying UNION ALL SELECT NULL,NULL probe a login endpoint; the tool files them under union-based and shows the raw query string as the matched fragment.

Example 2 — Obfuscated tautology. id=1%27%20OR%20%271%27%3D%271 decodes to 1' OR '1'='1. The boolean-based rule matches the quoted equality directly, not just a bare-digit 1=1 form, so this classic login-bypass payload is caught in the default Normal profile without needing Strict mode.

Example 3 — Time-based automation. Repeated WAITFOR DELAY '0:0:5' requests alongside AND pg_sleep(5) patterns both land in the time-based category regardless of which database engine the payload targets — the attacker is fingerprinting the backend by how long the response takes.

Example 4 — Stacked destructive query. A search field carrying x'; DROP TABLE users; -- is caught twice over: once as a stacked query because a semicolon precedes a DROP statement, and again as comment injection because of the trailing --. Both hits are listed for that line, and the stacked-query category — risk level 5, the highest in the tool — drives the highest-risk summary indicator.

Example 5 — Metadata reconnaissance. A request querying INFORMATION_SCHEMA or calling SELECT VERSION() is flagged under the metadata-probe category, a lower-risk but still meaningful signal that someone is mapping your schema before attempting a more targeted attack.

• SQLMap-style signature coverage — tuned for real attack traffic across seven distinct technique categories.
• Catches quoted and bare tautologies alike — both OR 1=1 and ' OR '1'='1 trigger the boolean-based rule.
• Obfuscation-aware — percent-encoding decoded twice before any pattern runs.
• Categorized triage — the technique behind each hit drives how urgently you respond.
• Evidence per line — the exact matched snippet, not a black-box verdict.
• Tunable recall — switch to Strict mode when you would rather over-flag than miss something.
• Private — all processing is client-side; sensitive request logs never leave your browser.