The latest articles on DEV Community by Malina Stepińska (@gh0stbloom). https://dev.to/gh0stbloom https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4129452%2F925e6989-0485-4b33-b5f5-1354d005b5b9.jpg https://dev.to/gh0stbloom en Malina Stepińska Thu, 12 Nov 2026 11:49:04 +0000 https://dev.to/gh0stbloom/sql-injection-in-the-where-clause-how-to-reach-unreleased-products-portswigger-2089 https://dev.to/gh0stbloom/sql-injection-in-the-where-clause-how-to-reach-unreleased-products-portswigger-2089 <h1> SQL injection in the WHERE clause: how to reach unreleased products (PortSwigger) </h1> <p>Another lab from PortSwigger Academy: <strong>SQL injection vulnerability in WHERE clause allowing retrieval of hidden data</strong>. The goal is simple: display one or more unreleased products via SQL injection.</p> <h2> Starting point </h2> <p>The shop filters products by category. In Burp I intercepted the request for opening a product description. The GET request includes the parameter <code>productID=6</code>, the product number.</p> <h2> Hypothesis </h2> <p>Task tells us that server-side SQL query contains a <code>released = 1</code> condition. If so, perhaps <code>released = 0</code> would show products that haven't gone on sale yet. So the trick is to make that condition stop applying.</p> <h2> Where I got stuck </h2> <p>I forgot that closing the query takes more than an apostrophe <code>'</code>. You also need to <strong>comment out the rest of the statement</strong>, which is what the double dash <code>--</code> does. Without it, the remainder of the query either breaks the syntax or keeps filtering the results.</p> <p>Then came a second problem. In the "Gifts" category one unreleased product showed up, but the lab wasn't marked as solved. I looked at the solution and it turned out you need to display <strong>all</strong> products using the <code>1=1</code> method. In my opinion that contradicts the task wording "one or more", since the task suggests that one product or a few is enough.</p> <h2> Exploit </h2> <div class="highlight js-code-highlight"> <pre class="highlight sql"><code><span class="s1">' OR 1=1-- </span></code></pre> </div> <p>The condition <code>1=1</code> is always true, so the query returns every product, including those with <code>released = 0</code>. Just <code>'--</code> on its own should work too.</p> <h2> How to defend against it </h2> <p><strong>Parameterized queries.</strong> User input is passed to the query as a parameter rather than concatenated into the query text, so <code>'</code> and <code>--</code> can't change the query's structure.</p> <h2> Takeaways </h2> <ul> <li>With SQLi, think about the whole query, not just the injection point: you need to close the string and comment out the rest.</li> <li>Solving a lab can depend on a specific condition being checked, not just on the results looking right.</li> </ul> cybersecurity security sql