Injection Filter Tester

About Injection Filter Tester

Injection is not really a category of attack, it is a category of mistake: data crossing into somewhere it is read as code. Which characters do that depends entirely on where the value lands. An apostrophe is inert in an HTML text node and decisive in a SQL string literal; an angle bracket is the reverse. So a filter is only ever safe *for one context*, and the usual failure is a single escaper applied everywhere — correct for the context it was written for, and a pass-through for every other.

This works per context. It shows the standard probes for one, and — the half that matters — reads back what your filter produced and says whether the value can still break out. Running probes is easy; reading the result correctly is where people conclude they are safe because nothing looked obviously wrong. The probes are deliberately non-destructive: each demonstrates escaping its quoting context and nothing more, because a test that has to be dangerous to be useful is a badly designed test.

Seventeen contexts are covered, and they are not all web pages. A shell argument, an HTTP header, a file path, an LDAP filter and a spreadsheet cell are injection contexts with their own rules, and several of them fail in ways that look nothing like the HTML case: a header value has no escaping syntax at all, an XPath literal has no escape for a quote, and a CSV cell becomes a formula because of its first character rather than anything inside it.

There is a third mode that judges one value against every context at once. That is this tool's own argument made concrete — checking a single context can only answer "is this safe *here*", and the answer people carry away is "is this safe", which is exactly how an escaper written for HTML ends up in front of a SQL query. A value that passes one context and is live in six makes that impossible to misread. It is not a suggestion to escape for all of them: a value escaped for every context at once is mangled in all of them.

Two of the probes read backwards, and the table says which. Most fail by surviving your filter unchanged; a few are harmless exactly as written and fail by coming back *changed* into the thing they were waiting to become — a value decoded a second time, or a quote escaped while the backslash in front of it was not. Marking those as passes is the easiest mistake to make here, so they are labelled rather than left to be inferred.

Where it helps

• Covers seventeen contexts separately, because a value safe in one is routinely unsafe in another.
• Goes beyond the web ones: shell arguments, HTTP headers, file paths, LDAP filters, XPath literals, template expressions and spreadsheet formulas.
• Judges one value against every context at once, which is the fastest way to see that safe-here does not mean safe.
• Checks your filter's output rather than just handing you payloads, which is the part that is actually hard to get right.
• Names what is still live and why it matters in that specific context.
• Always states the real remedy — parameterised queries, context-aware templating — rather than implying that escaping harder is the answer.

Limits

• A pass means these checks found nothing live in that one context. It is not a proof of correctness and never will be.
• It reads only the output, so it cannot know what your escaper intended or what it does with other inputs.
• There is no filter evasion here — no encoding tricks, no WAF bypasses — because the purpose is verifying your own escaping, not getting past somebody else's.
• Nothing here replaces a real security review, and a value that has to be hand-escaped is usually a value in the wrong place.

Frequently asked questions

Is this for attacking a site?

No. It is for checking your own escaping: it generates standard probes and reads back what your filter produced. The payloads are the minimal strings that demonstrate a context break, and none of them destroy data or reach the network.

My filter passed. Am I safe?

You are safe from these checks, in that one context. Use parameterised queries and a templating engine that escapes by context; hand-written escaping is a second line, not a first.

Why is the unquoted attribute context so hard?

Because a space alone ends an unquoted attribute — no quote character is involved. There is no general way to escape safely into one. Quote the attribute.

Why is a spreadsheet cell an injection context?

Because a cell beginning with =, +, - or @ is a formula, and a spreadsheet evaluates it when the file is opened — on the machine of whoever downloaded your export, not yours. The file is perfectly valid CSV, so quoting the field correctly does not help. Prefix the lead character with an apostrophe, or write a real spreadsheet file with the cell typed as text.

Why does the HTTP header context have no probe that fails normally?

Because every character that is dangerous in a header value is a control character, and a probe has to be visible to be pasted anywhere. So all of them are inert: they test whether some layer of your pipeline turns %0d%0a, or a literal backslash-r-backslash-n, into a real line break. If one comes back as an actual break, that is response splitting.

Why does a LIKE pattern need escaping if I use placeholders?

A placeholder stops injection, but % and _ are still wildcards inside the parameter. A user searching for % matches every row, which is a denial-of-service rather than a breach but is still a problem.

Related tools

• Regex Tester — Test patterns, inspect groups and preview replacements
• URL Encoder — Percent-encode components or whole URLs
• HTML Entities — Escape and unescape HTML entities
• Log Analyzer — Summarise a log: rates, errors, slowest paths and busiest clients
• HAR Analyzer — A network recording as a waterfall: what was slow, heavy, uncached or failing
• IDN Homograph Detector — Check whether a domain name is imitating another one

More Analyzers tools

• Log Analyzer — Summarise a log: rates, errors, slowest paths and busiest clients
• HAR Analyzer — A network recording as a waterfall: what was slow, heavy, uncached or failing
• IDN Homograph Detector — Check whether a domain name is imitating another one
• Phishing URL Checker — Where a link really ends up, how old the domain is, and which tricks it uses
• Stack Trace Analyzer — Read a stack trace or crash in any common language: the cause, your frames, and what it usually means