Practice range. VulnShop breaks on purpose so scanners have something to find. Keep it on 127.0.0.1 — never put it on the internet.
Vulnshop. Merch for people who read the source

Shop floor

Results for “x' OR '1'='1”

0 items
Why the last chip works: q is formatted into the SQL string with no parameter binding, so a quote ends the literal and the rest runs as query logic. Errors from a broken payload come back as a 500 with the trace, like /boom.

Nothing matched “x' OR '1'='1”

The shelves only hold 12 items, so try a shorter word — mug, tee, bag — or show everything.