SQL Injection

SQL injection is attackers splicing malicious SQL fragments into a query string so the database executes unintended commands.

Purpose

To keep attackers from manipulating SQL queries through input, stealing or tampering with the database.

Mechanism

When user input is concatenated directly into the SQL string (e.g., "SELECT * WHERE name='"+input+"'"), entering ' OR 1=1 -- can bypass the condition. Defenses: parameterized queries (prepared statements), ORMs, input validation, least-privilege accounts.

Use cases

Login bypass (' OR 1=1)
Data leakage (UNION SELECT)
Data tampering (UPDATE/DELETE)
Command execution (xp_cmdshell)

Examples

Input
```
admin' --
```
Output
```
Bypasses password verification
```
Comments out the password condition

Common errors

Building SQL with string concatenation: Always use parameterized queries

Related terms

XSS (cross-site scripting) is attackers injecting malicious scripts into a page that execute in other users browsers; it comes in stored, reflected, and DOM-based forms.

CSRF (cross-site request forgery) is a vulnerability where the attacker tricks a logged-in user into unknowingly sending a malicious request to the target site.

SQL (Structured Query Language) is the standard query language of relational databases, defining and manipulating data declaratively (DDL/DML/DQL/DCL).

Related tools

Beautify or minify SQL queries online. Uppercase keywords, indent clauses, or compress to a single line. Free, private, and 100% client-side.

References