SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This can enable attackers to view, modify, or delete data that they are not normally able to access, potentially leading to unauthorized access to sensitive information such as passwords, credit card details, and personal user information¹².

How SQL Injection Works

SQL injection typically occurs when user input is directly included in SQL queries without proper validation or sanitization. For example, consider the following code snippet that constructs a SQL query using user input:

If an attacker inputs 105 OR 1=1, the resulting SQL query becomes:

Since 1=1 is always true, this query returns all rows from the Users table, potentially exposing sensitive data²³.

Types of SQL Injection Attacks