SQL Injection
User input is concatenated into a SQL query, letting an attacker alter query logic to read, modify, or destroy data.
Overview
When input is interpolated into SQL instead of bound as a parameter, attacker syntax changes the query’s meaning. Variants include error-based, UNION-based, boolean/time-based blind, and out-of-band exfiltration.
How it works
When input is interpolated into SQL instead of bound as a parameter, attacker syntax changes the query’s meaning. Variants include error-based, UNION-based, boolean/time-based blind, and out-of-band exfiltration.
Example
Impact
Full database disclosure, authentication bypass, data tampering, and in some configurations remote command execution via database features.
Detection
Send boolean, error, and time-based payloads per parameter and compare responses and latency to a baseline. Correlating timing deltas with error signatures, rather than relying on either alone, is what separates a confident finding from a coincidental delay.
Prevention
- Always use parameterized queries / prepared statements.
- Use an ORM correctly and never string-build queries from input.
- Apply least-privilege database accounts and disable dangerous functions.
- Validate and allowlist where structure (column/table names) cannot be parameterized.