⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A05 – Injection

OWASP A05:2025 CWE-89 CWE-78 CWE-79

Injection is a single idea — user data is treated as code by an interpreter. The interpreter changes (SQL engine, shell, browser), the bug pattern is identical.

CWE-89 SQL Injection CWE-78 OS Command Injection CWE-79 Reflected XSS
CWE-89 SQL Injection

The app builds SQL by string concatenation. A single quote in the input closes the literal — and the rest is parsed as SQL.

Vulnerable code: 
q = "SELECT id, username, ssn FROM users WHERE username = '" + name + "'"
cursor.execute(q)

Try it yourself

Look up a real user

Enter alice — one row returned.

Break out with a quote

Enter ' OR '1'='1' --. The quote closes the literal, OR '1'='1' is always true, -- comments the rest.