SQL injection

The flaw was publicly described in Phrack issue 54 in December 1998 by Jeff Forristal (writing as rain.forest.puppy) and is catalogued as CWE-89. It arises whenever a query is assembled by string concatenation, as in "SELECT * FROM users WHERE name = '" + input + "'". Input such as ' OR '1'='1 closes the string literal and changes the WHERE clause; a trailing comment sequence (-- or #) discards the rest of the original statement. The same mechanism applies to ORDER BY clauses, LIKE patterns, stored procedures that build dynamic SQL with EXEC, and ORM "raw" query methods.

Exploitation techniques are grouped by how data comes back. In-band attacks read results directly, either through UNION SELECT, which appends attacker-chosen columns to the legitimate result set once the column count and types match, or through error-based extraction, where verbose database errors leak values. Blind attacks infer data one bit at a time: boolean-based variants compare page responses for true and false conditions, and time-based variants use functions such as SLEEP() or pg_sleep() to create measurable delays. Out-of-band techniques make the database send data over DNS or HTTP. Second-order injection stores a harmless-looking value that is later concatenated into a query elsewhere, which is why validating only at the entry point is not enough. Tools such as sqlmap automate all of these.

The primary defence is parameterised queries (prepared statements), where the SQL text and the values travel separately to the database driver, so input can never be parsed as syntax. Parameters cannot stand in for identifiers such as table or column names or for keywords such as ASC and DESC; those must be mapped from an allowlist. Stored procedures are only safe if they do not build dynamic SQL internally. Escaping user input is a last resort, because it is database- and character-set-specific and has repeatedly been bypassed, for example through multi-byte encodings. Least-privilege database accounts, no stacked queries where the driver allows disabling them, and generic error pages limit impact.

Impact depends on the database and its privileges: beyond reading and modifying data, some platforms allow file writes or command execution, for example through xp_cmdshell on Microsoft SQL Server. SQL injection remains current; in 2023 the Cl0p group mass-exploited CVE-2023-34362, a SQL injection in Progress MOVEit Transfer, to steal data from a large number of organisations. It sits in the OWASP Top 10 Injection category, A05 in the 2025 edition.