SQL Injection

SQL injection is a vulnerability in which untrusted input is combined into a database query in a way that lets the input change the query's meaning. It can expose, modify or delete data and sometimes lead to full server compromise.

Why it matters

It has been well understood for decades yet still appears because of string-built queries. The fix is straightforward: use parameterized queries so data is never treated as code, apply least-privilege database accounts, and validate input. A web application firewall can add a layer but is not a substitute.

Example

Vulnerable pattern versus safe pattern:

// Unsafe
query = "SELECT * FROM users WHERE name = '" + name + "'"
// Safe
query = "SELECT * FROM users WHERE name = ?"; run(query, [name])

With the safe version, quotes in the input remain plain text.

Common mistakes

• Relying on manual escaping instead of parameterized queries.
• Connecting the app to the database as an administrator account.
• Showing raw database errors to users, which reveals structure.

Related

• XSS
• WAF
• Least privilege
• Vulnerability

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.