SQL injection
SQLi · SQL injection attack · blind SQL injection · SQL code injection · injection SQL
An attack that slips database commands into an input field or URL in order to read, change or delete data the attacker should never be able to touch.
In practice
The flaw appears when an application builds its SQL queries by pasting in whatever the user typed. An attacker can then bypass a login, dump an entire customer database or, in some cases, take over the server. Known since the late 1990s and simple to fix, it still features in the OWASP Top 10:2025 (A05, Injection), which counts more than 14,000 SQL injection CVEs.
In late May 2023, the Cl0p group exploited a previously unknown SQL injection flaw (CVE-2023-34362) in the MOVEit Transfer file transfer software. It installed a backdoor and stole data from many organisations around the world before a patch was even available.
How to protect yourself
- Parameterised queries (prepared statements) everywhere, never string concatenation of user input.
- Allow-list validation for anything that cannot be parameterised (column names, sort order).
- A least-privilege database account for the application.
- SAST code analysis and a penetration test before go-live; a WAF as an extra layer, never a substitute.
