Vulnerable: user input is concatenated straight into the query — it becomes part of the code.

Simulated login form

This "backend" is a few lines of JavaScript in your browser — no network request is ever made. Stored users: alice / hunter2, bob / correcthorse.

SELECT * FROM users WHERE user='' AND pass='';

About This Demo

SQL injection and cross-site scripting are the two longest-running entries on the OWASP Top-10 list of web application risks. Both share the same root cause: untrusted input is treated as trusted code. This simulation never touches a real server, database, or script engine — it reconstructs the vulnerable and secure code paths as plain, visible JavaScript so the mechanism, not just the outcome, is observable.