SQL Injection (SQLi)
SQL Injection occurs when untrusted data is sent to an interpreter as part of a command or query. An attacker can use this to manipulate database queries, read or modify data, and in severe cases, execute operating system commands.
Overview
SQL Injection (SQLi) is one of the most dangerous and prevalent web application vulnerabilities. It occurs when an application incorporates user-supplied data into SQL queries without proper sanitization or parameterization. Attackers exploit this by injecting malicious SQL statements through input fields, URL parameters, cookies, or HTTP headers to manipulate the backend database.
Types & Variants
In-Band SQLi
The attacker uses the same communication channel to launch the attack and gather results. Includes error-based and UNION-based techniques.
Blind SQLi
The application does not return database errors or query results directly. The attacker infers information through boolean conditions or time delays.
Out-of-Band SQLi
The attacker uses a different channel (DNS, HTTP) to exfiltrate data. Requires specific database features to be enabled.
Impact
Full database access, data theft, data modification, authentication bypass, and potentially remote code execution.
Examples
Classic Login Bypass
SELECT * FROM users WHERE username='' OR '1'='1' AND password='' OR '1'='1'
UNION-Based Extraction
SELECT name, price FROM products WHERE id=1 UNION SELECT username, password FROM users--
Remediation
Use parameterized queries (prepared statements), implement input validation, apply least-privilege database permissions, and use an ORM with proper escaping.
Always use parameterized queries or prepared statements
Implement strict input validation with allowlists
Apply the principle of least privilege to database accounts
Use stored procedures to abstract direct SQL access
Deploy a Web Application Firewall (WAF) as defense-in-depth
Regularly audit and test application code for injection flaws
Related SuperClue scanner checks
These scanner checks look for signs of SQL Injection (SQLi). What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works