SQL injection is an attack where malicious SQL code is inserted into application input fields to manipulate or extract data from a database without authorization.
TL;DR SQL injection (SQLi) is a code injection attack in which an attacker inserts malicious SQL statements into input fields that are passed to a database query. When the application fails to sanitize input, the database executes the attacker’s commands instead of the intended query. SQL injection is the #1 vulnerability in the OWASP Top 10 and can result in full database compromise, data exfiltration, authentication bypass, and in some cases, remote code execution. Prevention requires parameterized queries (prepared statements) — not input filtering alone.
What is SQL injection?
SQL injection (SQLi) is an attack technique in which an attacker inserts or “injects” malicious SQL code into a query that an application sends to its database. When the application concatenates unvalidated user input directly into a SQL query, the database interprets the attacker’s input as SQL commands and executes them.
SQL injection does not require exploiting a software vulnerability in the traditional sense — it exploits the failure to separate code from data. Any application that builds SQL queries using string concatenation from user-supplied input is potentially vulnerable.
SQL injection has been on the OWASP Top 10 list of critical web application security risks since the list was first published in 2003. According to the 2021 OWASP Top 10, injection flaws (including SQLi) rank #3, affecting 94% of tested applications.
How SQL injection works
Consider a login form that builds this query:
SELECT * FROM users WHERE username = '$username' AND password = '$password';A normal user submits maria and secret123. The query becomes:
SELECT * FROM users WHERE username = 'maria' AND password = 'secret123';An attacker submits ' OR '1'='1 as the username and anything as the password. The query becomes:
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'anything';Because '1'='1' is always true, the query returns all users — and the attacker is logged in as the first user in the database, often an administrator.
Types of SQL injection
In-band SQL injection
The attacker uses the same channel to inject the attack and retrieve results. The most common type.
| Sub-type | How it works |
|---|---|
| Error-based | Forces the database to return error messages containing data (e.g., table names, column values) |
| Union-based | Uses UNION SELECT to append a second query and return its results alongside the original |
Inferential (blind) SQL injection
The application does not return data directly, but the attacker infers information from behavior.
| Sub-type | How it works |
|---|---|
| Boolean-based | Sends queries that evaluate to true or false; infers data from different responses |
| Time-based | Uses SLEEP() or WAITFOR DELAY; infers data from how long the response takes |
Out-of-band SQL injection
The attacker triggers the database to send data to an external server (via DNS or HTTP requests). Less common but effective when in-band methods are blocked.
What SQL injection can achieve
| Impact | Description |
|---|---|
| Authentication bypass | Log in without valid credentials |
| Data exfiltration | Read any table the database user has access to — usernames, passwords, credit cards, PII |
| Data modification | INSERT, UPDATE, or DELETE records |
| Schema discovery | Enumerate tables, columns, and database structure |
| Privilege escalation | Exploit stored procedures to gain DBA privileges |
| Remote code execution | On some databases (e.g., MSSQL with xp_cmdshell), execute OS commands |
A successful SQL injection against a database with DBA privileges gives an attacker complete control over every table in the database.
How to prevent SQL injection
1. Use parameterized queries (prepared statements)
This is the only reliable defense. Parameterized queries separate SQL code from data — the query structure is defined first, then user input is passed as a parameter. The database never interprets the input as SQL.
Vulnerable (string concatenation):
query = "SELECT * FROM users WHERE username = '" + username + "'"Safe (parameterized):
query = "SELECT * FROM users WHERE username = ?"cursor.execute(query, (username,))Parameterized queries are available in every major programming language and database driver.
2. Use an ORM
Object-Relational Mappers (Django ORM, Hibernate, ActiveRecord, Sequelize) build parameterized queries by default. Avoid raw SQL methods that accept string interpolation.
3. Apply least privilege
The database account used by the application should have only the permissions it needs. A read-only reporting user should not have INSERT or DROP privileges. Limiting database user permissions limits the damage if SQLi succeeds.
4. Deploy a Web Application Firewall (WAF)
A WAF detects and blocks SQL injection patterns in HTTP requests. WAF protection catches known attack patterns and provides a critical defense-in-depth layer — but it does not replace parameterized queries.
5. Validate and sanitize input
Validate input type, length, and format. Reject input that doesn’t match expected patterns. This reduces attack surface but is not sufficient alone — attackers can encode or obfuscate payloads to bypass input filters.
SQL injection detection
Signs that an application may be vulnerable to SQL injection:
- Error messages containing SQL syntax (e.g.,
You have an error in your SQL syntax) - Different responses when appending
' OR '1'='1vs' OR '1'='2 - Time delays when injecting
SLEEP(5)orWAITFOR DELAY '00:00:05' - Unexpected data returned in response bodies
Security teams detect SQLi attempts via WAF logs, database query logs, anomaly detection on response times, and application error monitoring.
Frequently asked questions
What is SQL injection in simple terms? SQL injection is when an attacker tricks a website into running database commands that weren’t intended. If a login form takes your username and passes it directly into a database query without checking it first, an attacker can type SQL commands instead of a real username and manipulate the database.
Is SQL injection still a threat in 2026? Yes. SQL injection has been the most critical web application vulnerability for over two decades. Despite being well-understood, it persists because developers continue to build queries using string concatenation. Automated scanning tools and injection kits make it easy for attackers to find and exploit vulnerable endpoints at scale.
What is a parameterized query? A parameterized query is a SQL statement where user input is passed as a separate parameter, not concatenated into the query string. The database treats the input as data — never as SQL code. This is the most effective and reliable defense against SQL injection.
Can a WAF alone stop SQL injection? A WAF blocks known SQL injection patterns and provides important defense-in-depth, but it cannot be the only protection. Skilled attackers use encoding, case variations, and obfuscation to bypass WAF rules. The root fix is always parameterized queries in the application code.
What databases are affected by SQL injection? All relational databases that process SQL are potentially affected: MySQL, PostgreSQL, Microsoft SQL Server, Oracle, SQLite, and others. The specific SQL syntax used in attacks varies by database, but the underlying vulnerability — unsanitized input passed to a query — is the same across all.
What is the difference between SQL injection and XSS? SQL injection targets the database layer — the attacker sends malicious SQL to be executed by the database. XSS (Cross-Site Scripting) targets users — the attacker injects malicious JavaScript that runs in other users’ browsers. Both are injection attacks but exploit different layers of the application.
How does blind SQL injection work? In blind SQL injection, the application doesn’t return database data in its response. The attacker infers information by observing differences in behavior: if the page changes when a condition is true vs. false (boolean-based), or if the response is delayed when a sleep command is injected (time-based). This is slower but equally effective.
What is the OWASP ranking for SQL injection? Injection (including SQL injection) ranks #3 in the OWASP Top 10 2021, present in 94% of tested applications. In earlier editions (2013, 2017), injection ranked #1. It remains one of the most critical and consistently exploited vulnerability classes in web security.