← Back
Offensive security assessments

Second Order SQL Injection (SO-SQLi) Guide

Second Order SQL Injection (SO-SQLi) occurs when a malicious SQL payload is submitted and stored (e.g., in a database), and is executed later when the application reuses that data in an unsafe SQL query.

Why it matters

Second Order SQL Injection (SO-SQLi) occurs when a malicious SQL payload is submitted and stored (e.g., in a database), and is executed later when the application reuses that data in an unsafe SQL query. Unlike first-order SQLi, the injection doesn’t happen right away, it’s triggered in a separate step, often in a different part of the application.

How we test it

Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.

Testing approach

  • User submits input that is stored (e.g., during registration or profile update)
  • That input is saved without validation
  • Later, the application retrieves and uses the stored data in a SQL query
  • If this query is built unsafely, the injection is triggered.
  • Stored in DB as: No error yet, payload is saved.
  • query = "SELECT FROM logs WHERE username = '" + userfromdb + "'" SELECT FROM logs WHERE username = 'attacker' --' Query is broken → Injection succeeds.
  • Inject payloads like ' OR 1=1 -- into fields that are stored, not just reflected.
  • Track where that input reappears later in the app (logs, admin panel, reports).

What we look for

  • User submits input that is stored (e.g., during registration or profile update)
  • That input is saved without validation
  • Later, the application retrieves and uses the stored data in a SQL query
  • If this query is built unsafely, the injection is triggered.
  • Stored in DB as: No error yet, payload is saved.
  • query = "SELECT FROM logs WHERE username = '" + userfromdb + "'" SELECT FROM logs WHERE username = 'attacker' --' Query is broken → Injection succeeds.
  • Inject payloads like ' OR 1=1 -- into fields that are stored, not just reflected.
  • Track where that input reappears later in the app (logs, admin panel, reports).