Skip to main content

What does "SQL injection" mean?

SQLJunior~1 min read
Suggest an edit

SQL Injection is a vulnerability where an attacker inserts malicious SQL code into a query to access or modify data.

In simpler terms, when an application doesn't filter user input, an attacker can "append" their own SQL statement right through a form or URL.

An example of dangerous code

sql
query = "SELECT * FROM users WHERE login = '" + user_input + "'";

If a user enters:

javascript
' OR '1'='1

The query becomes:

sql
SELECT * FROM users WHERE login = '' OR '1'='1';

which returns every record from the users table.

SQL injections let an attacker:

  • obtain logins and passwords,
  • delete data (DROP TABLE),
  • change access rights.

To defend against it, use:

  • prepared statements,
  • parameterized queries,
  • validation and escaping of user input.

Summary: SQL injection is tampering with a query through user input, which can lead to a database breach.

Short Answer

Interview ready
Premium

A concise answer to help you respond confidently on this topic during an interview.

Suggest an edit