SQL Injection
SQL injection is a vulnerability where an attacker inserts malicious SQL fragments into an application's database query, letting them read, modify, or delete data they shouldn't be able to access. It occurs when untrusted input is concatenated directly into a query instead of being parameterized.
SQL injection (SQLi) happens when an application builds database queries by concatenating user-supplied input directly into the SQL string. Because the input is treated as query logic rather than data, an attacker can alter the query's meaning — for example, ending an input with ' OR '1'='1 to bypass a login check or '; DROP TABLE users; -- to destroy data.
Under the hood, the database has no way to distinguish the developer's intended query structure from attacker-injected syntax when they arrive as one blended string. The fix is parameterized queries (prepared statements), where the query structure is sent separately from the values, so user input can never be interpreted as SQL. ORMs and stored procedures help when used correctly, but string-built queries reintroduce the risk.
SQLi is one of the oldest and most damaging web vulnerabilities, tracked as CWE-89 and a long-standing member of the OWASP Top 10 injection category. A single injectable endpoint can expose an entire database, including credentials and personal data, which is why static analysis tools flag any query built from tainted, unparameterized input.