SQL Token Boundary Lab: Tokenizer, AST & Live Query Engine

SQL injection succeeds only when attacker-supplied text gets tokenized as if it were code the developer wrote. Instead of a decorative pipeline flythrough, this lab actually runs a hand-written tokenizer, recursive-descent parser and a tiny in-memory relational engine against real sample users and payments tables. Pick a canned attack string, choose vulnerable (string concatenation) or parameterized (bound placeholder) construction, and watch the real resulting token stream, the computed abstract syntax tree — laid out live from the actual parsed node count and depth, not a fixed diagram — and the literal rows the engine matches. AST node counts, rows returned and whether the payload was re-tokenized are all derived from genuinely executing the tokenizer/parser/evaluator pipeline on the exact query text each mode constructs, so the classic OR-bypass, stacked-query DROP and UNION-based exfiltration techniques all produce their real, distinct outcomes rather than a hardcoded number.