SQL Injection
An attack that inserts malicious database commands through vulnerable input fields to access or manipulate data.
·1 min read
SQL injection↗ is a web application attack where malicious database commands are inserted into vulnerable input fields, like a login form, tricking the application into running unintended queries against its database. A successful attack can expose, modify, or delete an entire database.
SQL injection has been a top web vulnerability↗ for over two decades despite being well understood, because it arises whenever user input is mixed directly into database queries. Using parameterized queries instead of raw string concatenation eliminates the risk entirely.