Skip to content

SQL Injection

Untrusted input reaching a database query as code rather than data. Decades old, still found, still devastating.

critical severity Web

What is it

SQL injection happens when input from a user is concatenated into a database query, so the database interprets part of that input as instructions rather than values.

How it works

An application builds a query by joining strings together, including something the user supplied. The user supplies something that closes the intended value and adds instructions of their own. The database, having no way to tell the difference, executes all of it.

The fix is structural rather than defensive: parameterised queries send the query and the values over separate channels, so user input can never become code.

Why it matters

A successful injection typically means the entire database, and frequently the ability to write files or execute commands on the host.

What can happen

Full disclosure of stored data, modification or destruction of records, authentication bypass, and in many configurations a foothold on the server itself.

How to detect it

Database errors surfacing to users, unusual query patterns or durations, spikes in failed queries, and web server logs containing SQL syntax in parameters.

How to defend

Use parameterised queries everywhere, without exception. Apply least privilege to the database account so an injection cannot reach everything. Validate input against expected shape. Do not surface database errors to users. Add a web application firewall as a second layer, never as the first.

Authorised lab

How ethical hackers test this

Tested in authorised assessments against systems in scope, with proof of concept limited to demonstrating access rather than extracting real data. Our Web Application Assessment range contains an injection flaw to find and document.

Testing without written authorisation is a criminal offence in most countries, including India under the Information Technology Act.