SQL Injection

Also Known As

TL;DR

Explanation

SQL Injection occurs when user-supplied data is concatenated into a SQL statement without parameterisation. An attacker can close the intended query early and append their own SQL — extracting every row in the database, bypassing login checks, or calling destructive commands. It is consistently the most exploited web vulnerability. The fix is always prepared statements with bound parameters; input sanitisation alone is not sufficient.

How It's Exploited

Diagram

flowchart TD
    INPUT[User Input<br/>' OR 1=1 --] --> CONCAT[String Concatenation<br/>SELECT * FROM users<br/>WHERE name = '' OR 1=1--']
    CONCAT --> DB[(Database<br/>returns ALL rows)]
    DB --> LEAK[Data Leak]
    subgraph Fix
        SAFE_INPUT[User Input] --> PREP[Prepared Statement<br/>? placeholder]
        PREP --> BIND[Driver escapes<br/>automatically]
        BIND --> SAFE_DB[(Database<br/>safe query)]
    end
style LEAK fill:#f85149,color:#fff
style SAFE_DB fill:#238636,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Using string escaping (addslashes, mysql_real_escape_string) instead of prepared statements — escaping is bypassable.
• Parameterising values but dynamically concatenating table or column names into queries.
• Assuming an ORM makes you immune — raw query methods like DB::statement() still allow injection.
• Forgetting second-order injection: safely stored input can re-enter a query unsafely later.

Code Examples

$id = $_GET['id'];
$users = $db->query("SELECT * FROM users WHERE id = $id");

$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
$stmt->execute([':id' => (int) $_GET['id']]);
$user = $stmt->fetch();

References

• ↗ https://owasp.org/www-community/attacks/SQL_Injection
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
• ↗ https://cwe.mitre.org/data/definitions/89.html

Tags

Related Terms