SQL Injection

What it is

SQL injection occurs when untrusted input becomes part of executable database-query structure instead of remaining data. It can allow unauthorized reading, modification, or deletion, depending on the vulnerable query and database privileges. The problem is not simply unusual punctuation in a form; it is failure to preserve the boundary between query instructions and supplied values.

How it works

An application constructs a query by joining input into SQL text. The database then interprets parts of that input as syntax. Inputs may originate in search fields, headers, imported files, or previously stored records. Parameterized queries keep supplied values separate; dynamic identifiers such as column names require a different controlled approach.

How people get tricked

A developer assumes input validation or hidden interface controls make string construction safe. Data stored earlier may also be assumed trustworthy when inserted into a later query. The attack can occur without deceiving an end user.

Example scenario

A reporting feature builds its database filter directly from submitted text. Instead of treating the text as a search value, the database interprets it as a changed query structure and returns records outside the intended scope.

Warning signs

• Database errors or security alerts linked to crafted inputs.
• Unexpected query behavior or unauthorized record access.
• Code review finds direct concatenation of untrusted values into SQL.

If it happens to you

Disable or repair the vulnerable query path, preserve logs, and determine which operations occurred. Assess exposed or changed data and rotate affected secrets where necessary. Fix sibling paths using the same construction pattern; a filter for one suspicious string is not a durable remedy.