Web › Module 1 › Lesson 5
Lab — SQL Injection Lab
Practice SQLi and parameterized fixes on DVWA or your own local lab—never real websites
Opening
Break it locally, fix it for real
This lab uses intentionally vulnerable apps like DVWA (Damn Vulnerable Web Application) or WebGoat running on your machine or lab VM. You will trigger classic SQLi, then rewrite the same feature with prepared statements. Do not test SQL injection against sites you do not own or lack written authorization to assess.
1. Step 1 — Start DVWA locally
Docker DVWA (example)docker run --rm -it -p 8080:80 vulnerables/web-dvwa # Browse http://localhost:8080 # Set DVWA Security to Low for learning, then raise it later
docker run --rm -it -p 8080:80 vulnerables/web-dvwa # Browse http://localhost:8080 # Set DVWA Security to Low for learning, then raise it later
2. Step 2 — Reproduce SQLi on SQL Injection page
Open DVWA → SQL Injection. Submit a numeric id, then try a union or boolean payload from earlier lessons. In Burp or browser devtools, watch how the response changes when conditions are true vs. false.
Sample DVWA payloads (your lab only) OR = UNION SELECT user, password FROM users -- " "1
OR = UNION SELECT user, password FROM users --
"
"13. Step 3 — Rewrite with parameterized query
safe_lookup.py — contrast with string concatimport sqlite3 def lookup_user_unsafe(user_id: str): # VULNERABLE — demo only return conn.execute(f"SELECT * FROM users WHERE id = {user_id}") def lookup_user_safe(user_id: str): return conn.execute( "SELECT * FROM users WHERE id = ?", (user_id,), ) # Try id = "1 OR 1=1" — safe version treats it as literal text
import sqlite3
def lookup_user_unsafe(user_id: str):
# VULNERABLE — demo only
return conn.execute(f"SELECT * FROM users WHERE id = {user_id}")
def lookup_user_safe(user_id: str):
return conn.execute(
"SELECT * FROM users WHERE id = ?",
(user_id,),
)
# Try id = "1 OR 1=1" — safe version treats it as literal text4. What You Should Notice
At Low security, DVWA falls to simple payloads. At Medium/High, filters force blind techniques—but parameterized code would block all of them at the source. Optional: run sqlmap against your local DVWA URL with --batch only on your lab instance.
Complete SQL injection lab
On local DVWA (or equivalent), reproduce one in-band and one blind SQLi technique, then implement the safe_lookup pattern so malicious input is treated as data—not SQL.
Knowledge Check
Ethical SQLi practice means:
Multiple choice
Knowledge Check
True or False: Parameterized queries prevent user input from altering SQL structure.
True or False