SQL Injection
SQL injection occurs when user input is concatenated directly into SQL queries without parameterization. Attackers inject SQL syntax to read unauthorized data, modify records, or execute system commands. The fix is simple and absolute: use parameterized queries (prepared statements) for every database interaction. No exceptions.
Definition
SQL injection is the most impactful web vulnerability class – it provides direct database access. When application code builds queries by string concatenation (SELECT * FROM users WHERE id = ' + userInput + '), an attacker can input ' OR 1=1 – to return all rows, ' UNION SELECT password FROM admins – to exfiltrate data, or '; DROP TABLE users; – to destroy data. Parameterized queries (prepared statements) completely prevent SQL injection by separating SQL structure from data values. The database engine treats parameters as literal values regardless of content – injected SQL syntax is never executed. Every modern database driver supports parameterization: $1 (PostgreSQL), ? (MySQL, SQLite), :name (Oracle), @param (.NET). ORMs (SQLAlchemy, Hibernate, ActiveRecord) use parameterization internally. Raw SQL with string formatting is the only path to SQLi – eliminate it from your codebase.
Examples
- –VULNERABLE: f"SELECT * FROM users WHERE name = '{name}'"
- –SAFE: cursor.execute('SELECT * FROM users WHERE name = %s', (name,))
- –sqlmap -u 'http://site.com/page?id=1' --dbs (automated SQLi detection)