SQL injection investigation starts with the request you can reproduce
Give sqlmap a captured request from an application you're authorized to assess, and it can investigate whether an input reaches a database query unsafely. The project documents database identification, schema inspection and data retrieval, with filesystem access and operating-system commands available under particular conditions. That makes it useful when you need to establish the consequences of a suspected SQL injection. You still have to know which application behavior you're testing and how much access the assessment permits.
The 15 MB checkout contains 861 files and roughly 189,996 source lines. Its scope is substantial despite the small download. The README sends you to python sqlmap.py -h for basic help and -hh for all options, then to the wiki for explanations. I'd choose it for a focused investigation alongside other assessment tools. A developer seeking general coverage of application security needs a broader scanner as well.
What happened when we ran it
Our run installed sqlmap commit c94f6d0 in 10 seconds, adding 35 packages and occupying 37 MB on disk. The build succeeded in 2 seconds. We used a fresh Debian container on October 16, 2026, with 3 CPUs, 8 GB of RAM and the ghcr.io/astral-sh/uv:python3.12-bookworm image. The container was unprivileged and held no secrets. Those results establish that the supplied installation and build steps completed in that environment.
Pytest failed with exit code 1 after 34 seconds. Its summary reported 94 passed, 1 failed, 6 skipped and 102 collection/setup errors. The log's own elapsed figure was 31.79 seconds. Several named modules, including test_users_enum.py, test_websocket.py and test_xpath.py, ended with io.UnsupportedOperation: redirected stdin is pseudofile, has no fileno(). The visible error concerns redirected input without a file descriptor. The excerpt doesn't establish which change would fix it.
The failed assertion came from TestJitGuard::test_normal_path_is_untouched_without_jit in tests/test_jit_guard.py. It expected an anonymized-issue reporting phrase that wasn't present in the captured output. That's a separate finding from the 102 collection/setup errors. Neither finding establishes how accurately sqlmap detects SQL injection against an application, because the supplied measurements contain no target-assessment results. A successful build doesn't resolve the failed suite.
Pip-audit reported 0 known vulnerabilities in the measured environment. The repository scan found a tests directory and 1 CI workflow file, with no Dockerfile. These are useful adoption facts, but the audit doesn't certify the tool's behavior against a live target. If a clean pytest run is a release requirement for your organization, this measured checkout hasn't met it. Keep the recorded commit and failure output with your evaluation.
Captured requests reduce configuration work, while sessions still need attention
The manual's -r option reads a raw HTTP request from a file, preserving details such as posted data and cookies. That is a practical starting point when an issue appears only after login or inside a particular form submission. The documented request controls include authentication, proxies and anti-CSRF tokens. You don't need a hosted scanning-service credential for the local CLI, but an authenticated target still needs valid application access.
Our 37 MB installed footprint makes local evaluation modest on disk. The harder setup question is whether sqlmap is exercising the same request that exposed the suspected flaw. An expired cookie or a request that lands on a login page changes what you're assessing. The manual gives you controls for those situations, and saved sessions can resume work. You should understand the request and its responses before trusting a long unattended run.
Higher risk settings can change database contents
The usage manual says risk level 2 adds heavy time-based queries, while level 3 adds OR-based checks. It explicitly warns that an OR expression inside an UPDATE can affect every table entry. That's a concrete reason to decline sqlmap for an assessment whose owner cannot permit those effects. Increasing a setting changes the requests sent to the application, so agree on allowed behavior before using it.
Detection also has limits worth understanding before adoption. In issue 6145's maintainer response, a tightly restricted MySQL ordering expression received an example showing detection with the latest revision. The same response said the case had too many constraints for enumeration, meaning retrieval of database information. The issue is closed. It supports a narrower conclusion than either guaranteed coverage or an unresolved universal failure: detecting a flaw and extracting information remain different outcomes.
October maintenance matters more than the January release date
GitHub recorded a push on October 16, 2026, alongside 31 open issues and PRs. Stable release 1.10 was published on January 1, 2026. That older release date doesn't indicate abandonment: the October issue response includes concrete detection guidance, and the maintainer acknowledged fixes prompted by the report. Pinning c94f6d0 preserves the basis of our measurements, while assessing a newer revision would require its own verification.
The documentation earns its keep through specifics such as request-file loading and the warning about UPDATE statements. Its cost is reading: the short README is an entry point into a much longer manual. Our 94 passing tests provide some positive evidence about the measured checkout, but they sit beside a failed assertion and collection errors. I'd budget time to reconcile the supported development workflow with your own checks before maintaining a fork.
Choose ZAP for broader web assessment or Nuclei for template checks
ZAP's web application scanner is the better starting point when you need broader application assessment and manual testing support. Nuclei's template-based scanner fits repeatable checks expressed as YAML templates. Choose sqlmap when investigating SQL injection is the actual job and someone can interpret the request, the database behavior and the allowed impact. If the assessment permits detection alone, stop there even when the tool offers data retrieval.