This is part 2 of our series on working through the PortSwigger Web Security Academy. This one covers SQL injection at a bird's-eye view - the four main attack shapes that show up over and over, with the smallest possible example of each. Later posts will drill into specific attack types.

Full notes on our wiki: SQL Injection.

What SQL Injection Is

SQL injection is a web security bug that lets attackers execute their own SQL against your database, by taking advantage of user inputs that are not sanitized before being pasted into a SQL query.

The reason it is worth …

This post is part 1 of a series. We spent a chunk of May and June 2023 working through the PortSwigger Web Security Academy labs, mostly the SQL injection track, and taking notes on our wiki as we went. This post is the setup - what the Academy is, why we picked it, and how it fits together. The posts that follow will cover the specific techniques.

What the Academy Is

PortSwigger makes Burp Suite, which is the standard tool for web application security testing. They also run a free online academy at portswigger.net/web-security, which consists of written lessons …