SQL Injection
SQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.
Term
description · examples · notesSQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.
Description
The consequences depend on how badly protected the application is. Sometimes the attacker only reads data they should not see. Sometimes they bypass the login, change the contents of the database or delete records. And if the account the application uses to reach the database holds too many rights, one malicious input can become a large incident.
SQL injection is an old, well-known ailment, and still alive. It survives not because it is mysterious but because the same lapses repeat: queries assembled by hand, weak testing, over-broad rights on the database account, and applications that show their errors to the user. Parameterized queries are not an elegant detail but basic hygiene.
Examples
- A search field returns data the user should not be able to see, because the application builds the input straight into the SQL query.
- The attacker changes the login logic so that the application accepts an account without recognizing the password.
- Blind SQL injection pulls data out of the database slowly, character by character, through differences in the application's responses.
Notes
- SQL injection is not solved by filtering out a few dangerous characters, but by parameterized queries and correct handling of the database.
- If the account the application uses to reach the database has over-broad rights, the consequences of an injection become far larger than they need to be, or ever should be.
Mentioned in the news
- 18. AVG 2026. Sajt RFZO-a preko noći nestao pa se vratio, u saopštenju o tome ni reči →
- 22. MAJ 2026. Drupal zakrpio SQL injection ranjivost u sloju koji sprečava SQL injection napade →
- 28. APR 2026. Kritična SQL injection ranjivost u LiteLLM-u aktivno se zloupotrebljava →
- 13. MAR 2026. SQL injection ranjivost u WordPress Ally pluginu ugrožava više od 200.000 sajtova →
- 14. APR 2026. CISA dodala šest aktivno iskorišćenih ranjivosti u Fortinet, Microsoft i Adobe softveru →
Techniques
carried out with 4Techniques used to carry it out. Select one to open its page.
Defenses
countered by 7How it is defended against. Select one to open its page.