SQL injection (SQLi) happens when user input is concatenated into a database query, letting an attacker change the query’s meaning. It can expose, modify or delete data and sometimes leads to full server compromise.
A vulnerable pattern
// Vulnerable: input is concatenated into SQL
query = "SELECT * FROM users WHERE email = '" + email + "'";
// Safe: parameterised query
query = "SELECT * FROM users WHERE email = ?";
db.execute(query, [email]);Types of SQLi
- In-band — results or database errors are returned directly in the response.
- Blind — the attacker infers data from true/false behaviour or response timing.
- Out-of-band — data is sent to an attacker-controlled server via DNS or HTTP.
Prevention
- Use parameterised queries / prepared statements everywhere.
- Use an ORM or query builder correctly — avoid raw string queries.
- Allow-list values that cannot be parameterised, such as column names and sort order.
- Run the application with a least-privilege database account.
- Treat a web application firewall as defence in depth, not the fix.