{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/sql-injection","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/sql-injection/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/sql-injection/"},"term":{"en":"SQL injection","da":"SQL injection"},"aka":{"en":["SQLi"],"da":["SQL-injektion"]},"domain":["security"],"cluster":"application-security","layer":"application","status":"current","era":1998,"summary":{"en":"An attack where text typed into a form is read by the database as a command, letting an outsider read or change its data.","da":"Et angreb, hvor tekst skrevet i en formular læses af databasen som en kommando, så en udefrakommende kan læse eller ændre dens data."},"body":{"formal":{"en":"An attack on a web application that builds database commands by pasting user input straight into the command text; crafted input changes the meaning of the command, so the database runs instructions the developer never intended.","da":"Et angreb på en webapplikation, der bygger databasekommandoer ved at sætte brugerens input direkte ind i kommandoteksten; særligt udformet input ændrer kommandoens betydning, så databasen udfører instruktioner, udvikleren aldrig havde tænkt sig."},"plain":{"en":"Like a form that says \"Pay the sum of ___ to Anna\", where someone writes \"10 kroner, and also pay everything to me\" in the blank - and the clerk simply does all of it.","da":"Som en blanket, hvor der står \"Betal beløbet ___ til Anna\", og nogen skriver \"10 kroner, og betal også alt til mig\" i feltet - og ekspedienten gør bare det hele."},"inPractice":{"en":"A small Danish online shop passes whatever is typed into its search box straight to its database; an attacker types a short piece of SQL instead of a product name, and the page lists every customer's email address and hashed password.","da":"En lille dansk webshop sender det, der tastes i søgefeltet, direkte videre til databasen; en angriber skriver et lille stykke SQL i stedet for et produktnavn, og siden viser alle kunders mailadresser og hashede adgangskoder."},"whyItMatters":{"en":"One weak form field can hand over a whole database, and the flaw still turns up in new code decades after it was first described - even though a simple habit, keeping input apart from the command, prevents it.","da":"Ét svagt formularfelt kan udlevere en hel database, og fejlen dukker stadig op i ny kode årtier efter, at den første gang blev beskrevet - selvom en enkel vane, at holde input adskilt fra kommandoen, forhindrer den."}},"deepDive":{"en":"The flaw was publicly described in Phrack issue 54 in December 1998 by Jeff Forristal (writing as rain.forest.puppy) and is catalogued as CWE-89. It arises whenever a query is assembled by string concatenation, as in \"SELECT * FROM users WHERE name = '\" + input + \"'\". Input such as ' OR '1'='1 closes the string literal and changes the WHERE clause; a trailing comment sequence (-- or #) discards the rest of the original statement. The same mechanism applies to ORDER BY clauses, LIKE patterns, stored procedures that build dynamic SQL with EXEC, and ORM \"raw\" query methods.\n\nExploitation techniques are grouped by how data comes back. In-band attacks read results directly, either through UNION SELECT, which appends attacker-chosen columns to the legitimate result set once the column count and types match, or through error-based extraction, where verbose database errors leak values. Blind attacks infer data one bit at a time: boolean-based variants compare page responses for true and false conditions, and time-based variants use functions such as SLEEP() or pg_sleep() to create measurable delays. Out-of-band techniques make the database send data over DNS or HTTP. Second-order injection stores a harmless-looking value that is later concatenated into a query elsewhere, which is why validating only at the entry point is not enough. Tools such as sqlmap automate all of these.\n\nThe primary defence is parameterised queries (prepared statements), where the SQL text and the values travel separately to the database driver, so input can never be parsed as syntax. Parameters cannot stand in for identifiers such as table or column names or for keywords such as ASC and DESC; those must be mapped from an allowlist. Stored procedures are only safe if they do not build dynamic SQL internally. Escaping user input is a last resort, because it is database- and character-set-specific and has repeatedly been bypassed, for example through multi-byte encodings. Least-privilege database accounts, no stacked queries where the driver allows disabling them, and generic error pages limit impact.\n\nImpact depends on the database and its privileges: beyond reading and modifying data, some platforms allow file writes or command execution, for example through xp_cmdshell on Microsoft SQL Server. SQL injection remains current; in 2023 the Cl0p group mass-exploited CVE-2023-34362, a SQL injection in Progress MOVEit Transfer, to steal data from a large number of organisations. It sits in the OWASP Top 10 Injection category, A05 in the 2025 edition.","da":"Fejlen blev beskrevet offentligt i Phrack nr. 54 i december 1998 af Jeff Forristal (under navnet rain.forest.puppy) og er katalogiseret som CWE-89. Den opstår, når en forespørgsel sættes sammen ved strengsammenkædning, som i \"SELECT * FROM users WHERE name = '\" + input + \"'\". Input som ' OR '1'='1 lukker strengen og ændrer WHERE-betingelsen; en afsluttende kommentar (-- eller #) smider resten af den oprindelige sætning væk. Samme mekanisme gælder ORDER BY-led, LIKE-mønstre, stored procedures, der bygger dynamisk SQL med EXEC, og ORM'ers metoder til \"rå\" forespørgsler.\n\nUdnyttelsesteknikkerne grupperes efter, hvordan data kommer tilbage. In-band-angreb læser resultaterne direkte, enten via UNION SELECT, der føjer kolonner valgt af angriberen til det legitime resultatsæt, når antal og typer af kolonner passer, eller via fejlbaseret udtræk, hvor detaljerede databasefejl lækker værdier. Blinde angreb udleder data én bit ad gangen: booleske varianter sammenligner sidens svar ved sande og falske betingelser, og tidsbaserede varianter bruger funktioner som SLEEP() eller pg_sleep() til at skabe målbare forsinkelser. Out-of-band-teknikker får databasen til at sende data via DNS eller HTTP. Second-order injection gemmer en uskyldigt udseende værdi, som senere sættes ind i en forespørgsel et andet sted, og derfor er validering alene ved indgangen ikke nok. Værktøjer som sqlmap automatiserer det hele.\n\nDet primære forsvar er parameteriserede forespørgsler (prepared statements), hvor SQL-teksten og værdierne sendes hver for sig til databasedriveren, så input aldrig kan tolkes som syntaks. Parametre kan ikke bruges til identifikatorer som tabel- og kolonnenavne eller til nøgleord som ASC og DESC; de skal slås op i en allowlist. Stored procedures er kun sikre, hvis de ikke selv bygger dynamisk SQL. Escaping af brugerinput er en sidste udvej, fordi det afhænger af databasen og tegnsættet og gentagne gange er blevet omgået, fx via multibyte-encodings. Databasekonti med mindst mulige rettigheder, slået stacked queries fra, hvor driveren tillader det, og generiske fejlsider begrænser skaden.\n\nKonsekvensen afhænger af databasen og dens rettigheder: ud over at læse og ændre data kan nogle platforme skrive filer eller køre kommandoer, fx via xp_cmdshell på Microsoft SQL Server. SQL injection er stadig aktuelt; i 2023 masseudnyttede Cl0p-gruppen CVE-2023-34362, en SQL injection i Progress MOVEit Transfer, til at stjæle data fra et stort antal organisationer. Det hører under OWASP Top 10's kategori Injection, A05 i 2025-udgaven."},"edges":[{"type":"requires","to":"cs/database","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/web-application","confidence":"high","strength":"normal"},{"type":"exploits","to":"security/vulnerability","why":{"en":"It works only where a program mixes user input into database commands without keeping the two apart.","da":"Det virker kun, hvor et program blander brugerens input ind i databasekommandoer uden at holde de to adskilt."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/data-breach","why":{"en":"A successful attack lets the outsider read, copy or change the data the database holds.","da":"Et vellykket angreb lader den udefrakommende læse, kopiere eller ændre de data, databasen rummer."},"confidence":"high","strength":"primary"}],"depth":6,"sources":[{"title":"OWASP - SQL Injection","url":"https://owasp.org/www-community/attacks/SQL_Injection","tier":"reference","publisher":"OWASP"},{"title":"OWASP Cheat Sheet Series - SQL Injection Prevention","url":"https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html","tier":"reference","publisher":"OWASP"},{"title":"OWASP Top 10:2025 - A05 Injection","url":"https://owasp.org/Top10/2025/A05_2025-Injection/","tier":"reference","publisher":"OWASP"}],"draft":true}