I installed XAMPP on my development PC, and started Apache HTTP server and MySQL.

It comes with a test page "CD collection", with the following back-end PHP code:

mysql_query("DELETE FROM cds WHERE id=".round($_REQUEST['id']));

I'm not an expert in PHP, I'm guessing the round call is there to prevent SQL injection. So I removed it from the PHP code, leaving the following:

mysql_query("DELETE FROM cds WHERE id=".$_REQUEST['id']);

I verified that I can modify the query parameters in the URL to do whatever I like to the database, so the SQL injection vulnerability is definitely there.

Now I'm trying to use sqlmap to find the SQL injection vulnerability. I run it like this:

python sqlmap.py -u ""

But it returns the following:

[16:01:47] [WARNING] GET parameter 'id' is not injectable [16:01:47] [CRITICAL] all parameters are not injectable, try to increase --level/--risk values to perform more tests. Rerun without providing the --te chnique switch. Give it a go with the --text-only switch if the target page has a low percentage of textual content (~15.27% of page content is text)

Any idea of what I may be doing wrong?

4 Answers 4


There is a huge probability, that your server doesn't display any errors/warnings. Sqlmap tries to inject sql inj.-like payloads and observes the webapp "state". As sqlmap hasn't got an access to your vulnerable code or DB content it could just only guess the potential vulnerability by observing webapp behaviour – in this case „visual” behaviour (no warnings/errors – no potential sql-inj.).

However, sqlmap gave you pretty nice hint: try to increase level/risk values:

    python sqlmap.py -u "http://..." --level=3 --risk=3

after that change you will increase the amount of payloads (sent to your webapp) and you will find blind sql.inj!. It means that on level 3 (and --risk=3) sqlmap doesn't check only „visible” effects. It uses some time-taking operation [BENCHMARK()] which delays server response if sql. Inj. occurs.

  • Thanks for the answer, it turns out that increasing the level and risk did work. Apologies to @D.W. who did ask me this earlier, but it appeared I wasn't running it properly. Commented Jun 6, 2012 at 7:42

Do you have to log into the web application, to visit that page? If so, sqlmap doesn't have your authentication cookie, so you may need to feed it a valid cookie with --cookie=....

I don't have much experience with sqlmap, but I noticed one web page online claims that sqlmap 0.9 is unreliable and the latest development version is more reliable. That's one more thing you could try.

There's always the obvious: did you try the recommendations it suggests in the output you quoted?

  • No, there is no authentication required. I downloaded the latest version of sqlmap but the results are the same. And yes, I tried the recommendations in the output, but no luck. Commented Jun 4, 2012 at 7:57

1) Please use the latest revision from our repository (from your given output it's obvious you are using older v0.9 - a lot of things has changed till then):
$ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

2) Error messages are not necessity for sqlmap's detection (as is on other "tools"). Sqlmap's finds way how to inject something to use it and it doesn't "only" look for error messages (which don't prove anything)

3) Increase level/risk when you are sure that it should be exploitable (e.g. --level=3 --risk=3) but in most number of non-OR cases default level/risk should be enough

Kind regards,
Miroslav Stampar


C'mon stack exchange! Really? This is so easy to answer! Take another look:


See it yet? Your SQL injection is being rounded out of the picture! PHP is rounding "0 OR 1 = 1;--" to just 1. Remove the round function and hack yourself all night.

  • 1
    He DID remove the round function and WAS able to inject. Try re-reading the question in full.
    – Rodney
    Commented Mar 30, 2015 at 13:58
  • 1
    Who is criticising SE users on Christmas morning...
    – Aphire
    Commented Mar 11, 2016 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .