SQL injection

SQL injection is an attack that smuggles a malicious fragment of an SQL query through an application's unvalidated input. If a program without proper protection inserts user data directly into a query, an attacker can change its meaning and gain unauthorized access to the database. It is one of the oldest and most dangerous vulnerabilities listed in the OWASP Top 10.

How SQL injection works

The attack is possible when an application builds an SQL query by simply concatenating text with data typed by the user — for example in a login form, a search field or a URL parameter. Instead of an ordinary value, the attacker enters a crafted string that "closes" the original query and appends their own commands. This lets them:

• bypass authentication and log in without knowing the password,
• read data they are not authorized to access (such as the entire user table),
• modify or delete records,
• in extreme cases execute system commands on the database server.

Variants of the attack include error-based injection, time-based (blind SQL injection) and UNION-based approaches that combine results.

SQL injection in practice

Protecting against SQL injection is a mandatory part of secure development. The foundation is parameterized queries (prepared statements), which treat user data strictly as values, never as code. They are complemented by input validation, the principle of least privilege for the database account and layered defense using a web application firewall (WAF). Regular security testing and code audits — aligned with OWASP guidelines — catch vulnerable spots before an attacker does.