scan.now
Premium Scan a site

Scan a Web Page for SQL Injection Vulnerabilities

Enter a public page. Scan.now discovers its same-origin parameterized links and public GET forms, then looks for database errors introduced by a quote probe or repeatable differences between true and false conditions.

You can enter a normal page URL. Scan.now discovers public GET inputs on that page; if you already know the endpoint, you can paste its full parameterized URL. POST forms are never submitted.

A registered account is required to run this test. Finding status, evidence, affected locations and remediation are Premium-only. How active scanning works · Acceptable use

How the SQL injection check finds credible indicators

SQL injection occurs when application input changes the structure of a database query instead of remaining data. The externally visible clues are usually a database error introduced by malformed quoting, or a stable difference between a condition that is true and the same condition made false.

You can enter a normal page URL. Scan.now inventories same-origin links with query strings and public GET forms on that page, or tests the parameters in an exact URL you provide. It establishes an ordinary response for each discovered endpoint, then uses bounded quote and repeated true/false probes. It never asks the database for records and never sends INSERT, UPDATE, DELETE, UNION or time-delay payloads.

Put this result in context

This scanner answers one part of the review. Continue with Error Disclosure for detect exposed runtime exceptions and stack traces, then API Surface Scanner for inventory api hints, openapi documents and route counts. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read SQL Injection Explained: How It Works, Real Consequences and How to Prevent It and Website Security: What a Vulnerability Scan Looks For and How to Fix It. The SQL injection check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Error and true-or-false response signals

The check is deliberately bounded to the signals below.

Coverage areaWhat the scanner examines
Automatic input discoverySame-origin parameterised links and public GET forms on the entered page become bounded targets. Action-like delete, logout and unsubscribe URLs are excluded.
Database error changesA recognised SQL error counts only when it appears after the quote probe and was absent from that endpoint's ordinary baseline.
Repeated boolean differencesTrue and false variants are each requested twice. A difference must reproduce before it is treated as an indicator.

Reproduced indicators and clean responses

A scan result is evidence with a boundary, not a guarantee about every route.

Indicator reproduced

A quote introduced a database signature or repeated true/false conditions produced stable, materially different responses. Investigate the named parameter immediately.

No indicator

The discovered GET parameters did not reproduce either signal. The result does not cover POST bodies, JSON APIs, headers or parameters on pages that were not discovered.

No inputs discovered

The entered page exposed no suitable GET forms or parameterised links. Paste the exact endpoint URL if you know it, or scan a page where that input is visible.

Prepared queries and restricted database access

Use the recommendations below to address confirmed findings and strengthen the surrounding control.

  1. Parameterise every query

    Use prepared statements or the ORM's bound parameters. Concatenating a quoted or escaped value into SQL is still the wrong boundary.

  2. Allow-list structural choices

    Column names, sort directions and table identifiers cannot usually be bound; map a small set of user choices to constants instead.

  3. Use a restricted database account

    The application should have only the operations it needs. Separate migration and administration credentials from runtime credentials.

  4. Return generic errors

    Log the database exception privately with a correlation ID and send the visitor a stable application error that reveals no engine or query detail.

  5. Test the data-access layer

    Add negative tests for each public input and centralise query construction so a later feature cannot reintroduce string concatenation.

How it works

  1. Enter a relevant page

    A normal page URL works; an exact parameterised endpoint is optional when you already know what should be tested.

  2. We discover and baseline GET inputs

    Public forms and same-origin parameterised links are collected, with action-like URLs excluded.

  3. Bounded probes are repeated

    Quote and true/false response signals must differ from the ordinary response and reproduce before they are reported.

What this tool checks

1 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Page content and JavaScript

1 check

The ones that most often decide the grade:

Critical SQL injectionA GET parameter produced a repeatable database-error or boolean-response SQL injection indicator.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Active Security Error Disclosure Scanner

Detect exposed runtime exceptions and stack traces
Active Security API Surface Scanner

Inventory API hints, OpenAPI documents and route counts
Active Security XSS Vulnerability Scanner

Confirm reflected script injection in a URL parameter
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files

Guides for this tool

Background reading written to go with these results.

8 min read · Updated Sep 20, 2026 SQL Injection Explained: How It Works, Real Consequences and How to Prevent It

SQL injection turns user input into database commands. The mechanism with examples, why it is still common, why external scanners rarely...

Read the guide
13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide
8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Do I need to add ?id=123 to the URL?

No. The scanner can discover public GET forms and same-origin parameterised links on the page you enter. Supplying the exact URL is still useful when the endpoint is not linked from that page.

Does the scan read or download database records?

No. It does not use UNION queries, enumerate tables, request files, change data or introduce delays. It looks only for bounded error and response-difference indicators.

Why can a result be an indicator rather than absolute proof?

An external scanner sees HTTP responses, not the query or database. Stable true/false differences are strong evidence, but application state, caches or a security product can imitate them; code and log review provide final confirmation.

Will a web application firewall fix SQL injection?

A WAF may block familiar probes and reduce exposure, but it cannot make unsafe query construction correct. Parameterised queries are the fix; a WAF is an additional monitoring and containment layer.