SQL injection
Also known as: SQLi, SQL injection attack, SQL code injection
SQL injection is a web attack where an attacker types database commands into a website's input, such as a search box, login form, or web address, and the website mistakenly runs them against its database.
That can reveal customer records, bypass logins, or delete data. While SQL injection is decades old and easy to prevent with proper coding, it still appears regularly, including in a 2023 attack on the MOVEit file transfer tool that hit organizations worldwide.
SQL injection, explained at three levels
At home
Imagine a website's search box is supposed to look up a product name, but someone types a sneaky command instead, and the website obeys it, handing over its private data. That's SQL injection.
At work
SQL injection can expose an entire customer database through one vulnerable web form.
At home
Websites store information in databases and use a language called SQL to look things up. If a site carelessly mixes what you type into its SQL commands, attackers can rewrite those commands.
At work
The main fix is parameterized queries (prepared statements), which treat user input as data rather than code. Other layers include input validation, least-privilege database accounts, ORM frameworks, and web application firewalls.
At home
There's a famous web comic about a school database deleted by a student named 'Robert'); DROP TABLE Students;--'. In my opinion, it's the best one-line explanation of SQL injection ever drawn.
At work
Include SQL injection testing in code review, static analysis, and penetration tests. Watch third-party software too, since vendor products like MOVEit can expose you. Monitor for unusual database queries and limit what the web application's database account can access.
Real-world examples
At home
Marcus received a letter from a company saying his personal information was exposed in a breach. The cause was a SQL injection flaw in a file-sharing tool the company used.
At work
Sophie is a developer at a Halifax software firm. A code review found an old search page building SQL from raw input, and she rewrote it using parameterized queries before it reached production.
How it compares
| feature | SQL injection | Cross-site scripting (XSS) |
|---|---|---|
| Target | The website's database | Other users' browsers |
| Attacker injects | Database commands | Malicious scripts |
| Typical damage | Data theft, deletion | Session theft, fake content |
| Main fix | Parameterized queries | Output encoding and CSP |
SQL injection attacks the server's data. XSS attacks the site's visitors.
For analysts
I'd require parameterized queries as a coding standard and check vendor software for injection flaws. One unsafe form is enough to expose an entire database.
History & origin
Security researcher Jeff Forristal, writing as 'rain.forest.puppy,' described SQL injection in the hacker magazine Phrack in 1998. It quickly became one of the most common web vulnerabilities, ranking at or near the top of the OWASP Top 10 list for years. Albert Gonzalez used SQL injection as part of the 2008 Heartland Payment Systems breach, which exposed over 100 million card numbers. UK telecom TalkTalk was breached through SQL injection in 2015. In May 2023, the Cl0p ransomware group exploited a SQL injection flaw in Progress Software's MOVEit Transfer to steal data from thousands of organizations, including government bodies in Canada such as the Province of Nova Scotia. In my view, SQL injection's long life shows how hard it is to make secure coding the default.