Authentication & Security · In-Browser Regular Expression Lab

SQL Injection Regex — Detect Malicious SQL Keywords & Tautologies

Detects common SQL injection attempts including OR 1=1, UNION SELECT, comment dashes, and drops.

Pattern:

Regular Expression Pattern & Flags

Flags:

//i

Live Test String

Match Found

Load Sample:

Match Inspection & Details1 match

Match #1:' OR '

Test Samples Verification Matrix

Expected Valid Samples (Should Match)

admin' OR '1'='1 Pass

1; DROP TABLE users; -- Pass

test' UNION SELECT username, password FROM users -- Pass

Expected Invalid Samples (Must Reject)

john.doe@example.com Rejected (Pass)

valid_search_term Rejected (Pass)

12345 Rejected (Pass)

Code Implementation Generator

// JavaScript / TypeScript (ES6+)
const pattern = /('(''|[^'])*')|(;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|UNION)\b)|(\b(OR|AND)\b\s+['"\d]+[=<>]+['"\d]+)|(--|#|\/\*)/i;
const text = "admin' OR '1'='1";

const isMatch = pattern.test(text);
console.log("Is Match:", isMatch);

if (isMatch) {
  const matches = text.match(pattern);
  console.log("Matches:", matches);
}

Regular Expression Token Breakdown

Detects quotes, stacked statements, boolean tautologies (OR 1=1), and SQL comment indicators. Each component of the regular expression serves a distinct syntactical purpose as mapped below:

Token Pattern	Name / Component	Function & Rule
('(''\|[^'])*')	Quoted Literals	Detects SQL quote string injection.
(;\s*SELECT\|...)	Stacked Queries	Detects semicolon followed by SQL command.
\b(OR\|AND)\b\s+...	Boolean Tautologies	Detects 'OR 1=1' authentication bypass patterns.
(--\|#\|\/\*)	SQL Comments	Detects inline comment characters used to neutralize queries.