SQL Injection
An attack in which user input is pasted into a database query and gets run as code, prevented by keeping the query and its data in separate channels.
SQL injection is an attack in which input supplied by a user ends up being executed as part of a database query. It happens when code builds SQL by pasting strings together. A login check written as "SELECT * FROM users WHERE name = '" + name + "'" works for ordinary names, but a name of ' OR '1'='1 turns the condition into one that is always true. Other inputs can read every table, change data, or delete it.
The underlying flaw is mixing code and data in the same channel. The database receives a single string and can't tell which parts the programmer wrote and which came from the user. Every injection attack shares this shape: Cross-Site Scripting mixes user input into HTML, shell injection into commands, and Prompt Injection into the instructions given to a language model.
The attack was first described publicly in 1998 by Jeff Forristal, writing as "rain.forest.puppy" in the hacker magazine Phrack. It quickly became one of the most exploited weaknesses on the web and topped the OWASP list of critical web risks for years. Major breaches, including the 2008 Heartland Payment Systems theft of over 100 million card numbers, began with it. The xkcd comic "Exploits of a Mom" made it famous with a student named Robert'); DROP TABLE Students;--, known ever since as Little Bobby Tables.
The fix is well established:
- Parameterized queries. The query is written with placeholders,
WHERE name = $1, and values are sent separately. The database parses the query first and treats the values strictly as data, so no input can change its structure. These are also called prepared statements. - Query builders and ORMs. An Object-Relational Mapping library or query builder parameterizes automatically, as long as developers avoid its raw-SQL escape hatches.
- Allowlists for structure. Parts of a query that can't be parameterized, such as a column to sort by, should be chosen from a fixed list, never copied from input.
Escaping special characters by hand is the classic wrong fix. It is easy to get wrong across character sets and database dialects, as encoding tricks described under Character Encoding have shown.
Layered defenses limit the damage when something slips through. The application's database account should follow Least Privilege, unable to drop tables or read data it doesn't need. Input checks through Schema Validation reject obviously malformed values early. Static Analysis tools flag string-built queries, and Fuzzing and security scanners probe for injectable parameters.
SQL injection has declined as frameworks made parameterization the default, but it persists in legacy code, hand-built reporting queries, and anywhere a developer reaches for string concatenation because it seemed quicker. It remains a standard case for the principle that the safe path should also be the easy one.
See also3
PHP
The server-side language that began in 1994 as a personal set of homepage tools, spread on cheap shared hosting to run much of the web including WordPress and early Facebook, and survived years of ridicule by getting much faster and stricter.
Web Platform10 connections
SQL
The declarative language for asking questions of relational databases, designed at IBM in the 1970s, standardized in 1986, repeatedly declared obsolete and still the most widely used way to read and write structured data.
Data & Content9 connections
WordPress
The open-source PHP publishing system forked from b2 in 2003 that grew from a blogging tool into the software behind a large share of all websites, held together by themes, plugins, and a strict commitment to backward compatibility.
Web Platform12 connections
Linked from12
- Cross-Site ScriptingWeb Platform
Injecting attacker-controlled script into a page that a victim's browser then executes with the victim's own privileges.
- CSVData & Content
The plain-text table format of rows separated by line breaks and fields separated by commas, universal and simple until quoting, encoding, and spreadsheets get involved.
- Defensive ProgrammingTesting & Verification
Writing code that anticipates misuse and bad input, checking assumptions and handling the unexpected rather than trusting callers, along with the debate over when defense should give way to failing loudly.
- Form ValidationWeb Platform
Checking what people type into a web form before accepting it, done in the browser for fast feedback and on the server for safety, and harder than it looks because real names, addresses, and numbers break simple rules.
- Object-Relational MappingData & Content
A library that lets code treat database rows as ordinary objects, saving a great deal of boilerplate at the cost of hiding the queries that actually run.
- PHPWeb Platform
The server-side language that began in 1994 as a personal set of homepage tools, spread on cheap shared hosting to run much of the web including WordPress and early Facebook, and survived years of ridicule by getting much faster and stricter.
- Prototype PollutionWeb Platform
A JavaScript vulnerability where attacker-controlled keys like "__proto__" modify the prototype every object inherits from, silently adding properties everywhere, and how merge utilities and parsers let it in.
- Schema ValidationAgents & Language Models
Checking data against a declared shape at runtime, and using the result as the typed value.
- SQLData & Content
The declarative language for asking questions of relational databases, designed at IBM in the 1970s, standardized in 1986, repeatedly declared obsolete and still the most widely used way to read and write structured data.
- Static AnalysisTesting & Verification
Finding bugs by examining code without running it, from linters and type checkers to deep security analysis, always trading missed bugs against false alarms.
- Threat ModelingTesting & Verification
A structured way of asking what could go wrong with a system's security before an attacker answers it, by drawing where data flows, marking where trust changes, and walking each crossing through a list of threats.
- WordPressWeb Platform
The open-source PHP publishing system forked from b2 in 2003 that grew from a blogging tool into the software behind a large share of all websites, held together by themes, plugins, and a strict commitment to backward compatibility.