These are the published, widely documented test strings that appear in every security checklist — ' OR '1'='1, <script>alert(1)</script>, ../../etc/passwd. Their job here is to be pasted into your own form so you can confirm nothing happens.
What you can control
- Nine payload families covering the injection classes that appear in the OWASP Top Ten.
- Each payload comes with the behaviour a correctly written handler should show, so you know what you are checking for.
- Four encodings, because a payload that is blocked raw often gets through URL-encoded.
- These are canonical, published strings — no novel exploits, no evasion techniques.
What this is not
Use these against systems you own or have written permission to test. Running them against someone else's application without authorisation is illegal in most jurisdictions, regardless of intent.
Questions
What is this for?
Confirming that your own input handling is safe. You paste a payload into your form and verify it comes back as visible text, not as executed markup or a modified query.
Why does the encoding matter?
Because filters are often applied at one layer and bypassed at another. A payload blocked in raw form may pass URL-encoded and get decoded later, which is where the vulnerability lives.
Are these actual exploits?
No. They are the canonical detection strings published in every security testing guide. They reveal whether a vulnerability exists; they do not exploit one.