SQL Injection

SQL injection is a vulnerability in which untrusted input is combined into a database query in a way that lets the input change the query's meaning. It can expose, modify or delete data and sometimes lead to full server compromise.

Why it matters

It has been well understood for decades yet still appears because of string-built queries. The fix is straightforward: use parameterized queries so data is never treated as code, apply least-privilege database accounts, and validate input. A web application firewall can add a layer but is not a substitute.

Example

Vulnerable pattern versus safe pattern:

// Unsafe
query = "SELECT * FROM users WHERE name = '" + name + "'"
// Safe
query = "SELECT * FROM users WHERE name = ?"; run(query, [name])

With the safe version, quotes in the input remain plain text.

Common mistakes

• Relying on manual escaping instead of parameterized queries.
• Connecting the app to the database as an administrator account.
• Showing raw database errors to users, which reveals structure.

Related

• XSS
• WAF
• Least privilege
• Vulnerability

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.