Lably
Skip to content

SQL injection

Computer hacking technique

  • 20 min read
  • 6 chapters
Classification of the SQL Injection Web Attacking Vector, Status: 2010.
KDeltchev · CC BY-SA 3.0

Related on Lably

Through SQL, Database and Software

Lab · Class 11–12Databases & SQLLab · Class 6–12AI & Python Builds (Medha AI)Lab · Class 11Binary and Logic Gates

SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. Document-oriented NoSQL databases can also be affected by this security vulnerability.

SQL injection remains a widely recognized security risk due to its potential to compromise sensitive data. The Open Web Application Security Project (OWASP) describes it as a vulnerability that occurs when applications construct database queries using unvalidated user input. Exploiting this flaw, attackers can execute unintended database commands, potentially accessing, modifying, or deleting data. OWASP outlines several mitigation strategies, including prepared statements, stored procedures, and input validation, to prevent user input from being misinterpreted as executable SQL code.

History

Discussions of SQL injection began in the late 1990's, including in a 1998 article in Phrack Magazine. SQL injection was ranked among the top 10 web application vulnerabilities of 2007 and 2010 by the Open Web Application Security Project (OWASP). In 2013, SQL injection was listed as the most critical web application vulnerability in the OWASP Top 10.

In 2017, the OWASP Top 10 Application Security Risks grouped SQL injection under the broader category of "Injection," ranking it as the third most critical security threat. This category included various types of injection attacks, such as SQL, NoSQL, OS command, and LDAP injection. These vulnerabilities arise when an application processes untrusted data as part of a command or query, potentially allowing attackers to execute unintended actions or gain unauthorized access to data.

By 2021, injection remained a widespread issue, detected in 94% of analyzed applications, with reported incidence rates reaching up to 19%. That year’s OWASP Top 10 further expanded the definition of injection vulnerabilities to include attacks targeting Object Relational Mapping (ORM) systems, Expression Language (EL), and Object Graph Navigation Library (OGNL). To address these risks, OWASP recommends strategies such as using secure APIs, parameterized queries, input validation, and escaping special characters to prevent malicious data from being executed as part of a query.

Sign in to keep reading

5 more chapters are free with a Lably account.

More in Computing and communication

ISBNUnique numeric book identifier since 1970X (social network)American social networking serviceWayback MachineDigital archive by the Internet ArchivePython (programming language)General-purpose programming languageMacOSOperating system for Apple computersUnicodeCharacter encoding standard