SQL Injection Attack Log Detection

What This Means

Detect SQL injection attacks in web server access logs. Identify UNION-based, blind, and error-based injection attempts targeting your web applications with practical log analysis techniques.

Example Log

-- IIS/Nginx access log showing SQL injection attempts:
203.0.113.55 - - [08/Mar/2026:14:22:31 +0000] "GET /products?id=1%27%20OR%201%3D1-- HTTP/1.1" 500 1205
203.0.113.55 - - [08/Mar/2026:14:22:33 +0000] "GET /products?id=1%27%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 500 892
203.0.113.55 - - [08/Mar/2026:14:22:35 +0000] "GET /products?id=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1" 200 0
203.0.113.55 - - [08/Mar/2026:14:22:42 +0000] "GET /products?id=1%27%20AND%20SUBSTRING(@@version,1,1)=%275%27-- HTTP/1.1" 200 4521

Indicators of Suspicious Activity

• URL-encoded SQL keywords in query parameters: UNION, SELECT, INSERT, UPDATE, DELETE, DROP
• Single quote characters (%27) or comment sequences (--) in URL parameters
• SQL functions in URLs: WAITFOR, SUBSTRING, CONCAT, CHAR, CONVERT
• Server responding with 500 errors to requests containing SQL fragments
• Time-based blind injection: requests with WAITFOR DELAY showing slow responses
• Error-based injection: response sizes varying based on injected boolean conditions

How to Investigate

1. Search access logs for SQL keywords in cs-uri-query and cs-uri-stem (URL-decoded)
2. Identify the injection point (which parameter on which endpoint)
3. Check if any injection attempts received 200 responses (potential successful exploitation)
4. Look for data exfiltration indicators (large response sizes, UNION SELECT patterns)
5. Review application error logs for SQL syntax errors generated by injection attempts
6. Determine if the attacker progressed from detection to exploitation

Recommended Mitigations

• Use parameterized queries (prepared statements) for all database operations — never concatenate user input
• Deploy a WAF with SQL injection rule sets (OWASP CRS or commercial equivalent)
• Implement input validation that rejects or escapes special characters
• Apply the principle of least privilege for database connection accounts
• Enable database query logging to detect successful injection post-exploitation
• Conduct regular penetration testing and code review for injection vulnerabilities

Related Log Types

Related Attack Patterns

Frequently Asked Questions