SQL Injection
Sitecheck Team
An attack where malicious SQL code is inserted into queries via user input.
SQL injection (SQLi) occurs when an attacker inserts malicious SQL code into an input field or URL parameter, causing the database to execute unintended commands. It can expose, modify, or delete data — in severe cases giving full control of the database.
Why it matters: SQL injection is consistently ranked among the most common and damaging web vulnerabilities, and fully preventable with standard practices.
Quick tips:
- Use parameterised queries or prepared statements — never concatenate user input directly into SQL strings.
- Apply an ORM layer to abstract direct query construction.
- Limit database user permissions to only what the application needs (principle of least privilege).