SQL Injection
A code injection attack that exploits vulnerabilities in web applications to execute malicious SQL queries against backend databases.
SQL injection (SQLi) is a web security vulnerability that allows attackers to interfere with the queries an application makes to its database. By inserting or "injecting" malicious SQL code through user input fields — such as login forms, search boxes, or URL parameters — attackers can manipulate database queries to access, modify, or delete data they should not be authorized to reach. SQL injection consistently ranks among the most critical web application vulnerabilities.
SQL injection exploits occur when applications construct database queries by concatenating user-supplied input directly into SQL statements without proper sanitization or parameterization. A simple example: if a login form inserts the username directly into a query like "SELECT * FROM users WHERE username = '[input]'", an attacker can enter a specially crafted string that alters the query's logic — potentially bypassing authentication entirely or extracting the full contents of the database. Advanced techniques include union-based injection (combining results from multiple tables), blind injection (inferring data from application behavior), and out-of-band injection (exfiltrating data through DNS or HTTP requests).
The impact of SQL injection can be devastating. Attackers can extract entire databases containing customer data, credentials, and financial records. They can modify or delete data, create administrative accounts, and in some cases gain operating system-level access to the database server. Some of the largest data breaches in history — affecting hundreds of millions of records — have been caused by SQL injection vulnerabilities. Prevention is straightforward: use parameterized queries or prepared statements exclusively, and never construct SQL by concatenating user input.
SQL injection exploits occur when applications construct database queries by concatenating user-supplied input directly into SQL statements without proper sanitization or parameterization. A simple example: if a login form inserts the username directly into a query like "SELECT * FROM users WHERE username = '[input]'", an attacker can enter a specially crafted string that alters the query's logic — potentially bypassing authentication entirely or extracting the full contents of the database. Advanced techniques include union-based injection (combining results from multiple tables), blind injection (inferring data from application behavior), and out-of-band injection (exfiltrating data through DNS or HTTP requests).
The impact of SQL injection can be devastating. Attackers can extract entire databases containing customer data, credentials, and financial records. They can modify or delete data, create administrative accounts, and in some cases gain operating system-level access to the database server. Some of the largest data breaches in history — affecting hundreds of millions of records — have been caused by SQL injection vulnerabilities. Prevention is straightforward: use parameterized queries or prepared statements exclusively, and never construct SQL by concatenating user input.
Examples
- Entering ' OR 1=1 -- in a login form to bypass authentication by making the SQL query always return true.
- Using a UNION SELECT statement in a search field to extract data from other database tables like user credentials.
- Injecting a DROP TABLE command through a URL parameter to destroy a database table.
Prevention
- Use parameterized queries or prepared statements for all database interactions — never concatenate user input into SQL.
- Implement input validation and sanitization as a defense-in-depth measure.
- Apply the principle of least privilege to database accounts used by web applications.
- Deploy a web application firewall (WAF) to detect and block common SQL injection patterns.