{"record":{"id":"4557f3f5a2c2cdd4","repo":"sqlmapproject/sqlmap","slug":"all-tested-parameters-do-not-appear-to-be-injectab","errorCode":null,"errorMessage":"all tested parameters do not appear to be injectable.","messagePattern":"all tested parameters do not appear to be injectable\\.","errorType":"validation","errorClass":"SqlmapNotVulnerableException","httpStatus":null,"severity":"error","filePath":"lib/controller/controller.py","lineNumber":875,"sourceCode":"                    elif conf.regexp:\n                        errMsg += \" Also, you can try to rerun by providing a \"\n                        errMsg += \"valid value for option '--regexp' as perhaps the regular \"\n                        errMsg += \"expression that you have chosen \"\n                        errMsg += \"does not match exclusively True responses.\"\n\n                    if not conf.tamper:\n                        if kb.identifiedWafs:\n                            errMsg += \" As a WAF/IPS ('%s') was identified during the run, \" % \", \".join(kb.identifiedWafs)\n                            errMsg += \"you are strongly advised to retry with option '--tamper' (e.g. '--tamper=space2comment')\"\n                        else:\n                            errMsg += \" If you suspect that there is some kind of protection mechanism \"\n                            errMsg += \"involved (e.g. WAF) maybe you could try to use \"\n                            errMsg += \"option '--tamper' (e.g. '--tamper=space2comment')\"\n\n                        if not conf.randomAgent:\n                            errMsg += \" and/or switch '--random-agent'\"\n\n                    raise SqlmapNotVulnerableException(errMsg.rstrip('.'))\n            else:\n                # Flush the flag\n                kb.testMode = False\n\n                _saveToResultsFile()\n                _saveToHashDB()\n                _showInjections()\n                _selectInjection()\n\n            if kb.injection.place is not None and kb.injection.parameter is not None:\n                if conf.multipleTargets:\n                    message = \"do you want to exploit this SQL injection? [Y/n] \"\n                    condition = readInput(message, default='Y', boolean=True)\n                else:\n                    condition = True\n\n                if condition:\n                    try:","sourceCodeStart":857,"sourceCodeEnd":893,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/lib/controller/controller.py#L857-L893","documentation":"Reported at the end of start() when testing ran to completion but no injection was confirmed for any parameter. It is a results summary rather than a crash, and the surrounding code appends advisory hints (e.g. --string/--regexp tuning, WAF/IPS presence) when applicable.","triggerScenarios":"Thrown at lib/controller/controller.py:875 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Raise the risk/level (e.g. --level=5 --risk=3) so more injection techniques and parameter locations are tested","Tune boolean detection with --string/--regexp/--text-only when responses are volatile","If a WAF/IPS was identified, try evasion via --tamper or adjust the request with --hpp/--delay"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}