SQL Injection Demo

Educational demonstration — see how unsanitized input creates dangerous SQL queries

This is a purely educational simulation. No real database is involved. Understanding attacks is the first step to preventing them.

Login Form

Try these payloads (username):

Constructed SQL Query (Unsafe)

Parameterized Query (Safe)

Parameterized queries treat user input as data, never as SQL code. The database driver escapes all special characters automatically. This completely prevents SQL injection.

XSS Sandbox

Cross-Site Scripting — see how malicious HTML/JS behaves, and how to prevent it

Example payloads:

Unsafe Render (innerHTML)

Executing user input as HTML allows attackers to steal cookies, redirect users, deface pages, or run arbitrary JavaScript.

Safe Render (textContent)

Using textContent or proper sanitization prevents script execution. Content Security Policy (CSP) headers add another layer of defense.

Content Security Policy Example

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
CSP headers tell browsers which sources are legitimate. Even if XSS code is injected, CSP prevents it from loading external scripts or executing inline JavaScript.

Password Strength Analyzer

Real-time entropy calculation, crack time estimation, and educational hashing

Enter a password
Length
—
Character Set Size
—
Entropy (bits)
—
Estimated Crack Time
—
Lowercase
—
Uppercase
—
Numbers
—
Symbols
—

Hash Preview (client-side, educational)

MD5— SHA-1— SHA-256—
These hashes are computed in your browser using the SubtleCrypto API. MD5 and SHA-1 are broken for password storage — use bcrypt, scrypt, or Argon2 instead. SHA-256 alone without salting is also insufficient.

JWT Decoder

Paste a JSON Web Token to decode its header, payload, and signature