Improving Payload and SQL Injection Detection: Reviewing Similar Projects

[secfb]

When I checked the plugins below, they perform similar functions to yours. Your plugin's user interface is really excellent. However, I think it's slightly lacking in detecting SQL injection payloads and various database errors compared to the plugins below. Overall, the plugin could be improved to better anticipate potential false positives. I use this plugin a lot, I just wanted to offer suggestions for improvement.

https://github.com/saoshao/DetSql
https://github.com/darkfiv/DouSql

[JaveleyQAQ]

When I checked the plugins below, they perform similar functions to yours. Your plugin's user interface is really excellent. However, I think it's slightly lacking in detecting SQL injection payloads and various database errors compared to the plugins below. Overall, the plugin could be improved to better anticipate potential false positives. I use this plugin a lot, I just wanted to offer suggestions for improvement.

https://github.com/saoshao/DetSql https://github.com/darkfiv/DouSql

Thanks for your great feedback—I really appreciate you taking the time to share your thoughts.
To clarify, this plugin was not designed for full SQLi payload coverage from the beginning. Its core focus is lightweight, low-trigger detection in strict WAF environments. Under heavy WAF protection, sleep, EXP, and many common injection payloads simply won’t work, and a large payload list would only bloat the plugin, send too many requests, and increase the risk of being blocked.
Using only a small number of payloads to compare response differences helps keep the tool stealthy and efficient, even if it means lower overall coverage.
However, I do agree with your concerns and plan to add configurable switches for different detection modes so users can choose which types of checks to run. This will let the plugin adapt to both WAF-restricted and open environments.
If you have more specific ideas or examples you’d like to see supported, please let me know—it would help a lot. Thanks again!

[secfb]

You're absolutely right in what you wrote; I just wanted to share these plugins to give you ideas for further development. Generally speaking, these SQL injection vulnerabilities could perhaps be added to this plugin.

ORA-\d{5}
SQL syntax.*?MySQL
Unknown column
SQL syntax
java.sql.SQLSyntaxErrorException
Error SQL:
Syntax error
There is a syntax error nearby
java.sql.SQLException
Incomplete quotation marks
System.Exception: SQL Execution Error!
com.mysql.jdbc
MySQLSyntaxErrorException
valid MySQL result
your MySQL server version
MySqlClient
MySqlException
valid PostgreSQL result
PG::SyntaxError:
org.postgresql.jdbc
PSQLException
Microsoft SQL Native Client error
ODBC SQL Server Driver
SQLServer JDBC Driver
com.jnetdirect.jsql
macromedia.jdbc.sqlserver
com.microsoft.sqlserver.jdbc
Microsoft Access
Access Database Engine
ODBC Microsoft Access
Oracle error
DB2 SQL error
SQLite error
Sybase message
SybSQLException