SQL Injection

Updated 31 Jul 2026

•
def
- •
  inserting your own SQL commands into an application's database query, taking advantage of an application that doesn't properly validate input
•
example
- •
  an application builds a query like SELECT * FROM users WHERE name = ' + username + '; if the input isn't sanitized, an attacker can inject ' OR '1'='1 to manipulate the query's logic
•
impact
- •
  can allow viewing or deleting database contents, adding users, or denial of service
•
related
- •
  Cross-site Scripting (XSS)
•
cards
- •
  What causes SQL injection to be possible?
  - •
    An application fails to sanitize user input before inserting it into a database query, letting an attacker inject their own SQL logic

Linked references 6