Software Development
Trending
Static vs Dynamic Websites: Pros, Cons and Use Cases
Static or dynamic? A plain-English comparison of speed, security, cost and maintenance, with real examples of when each type of website makes sense.
Cybersecurity
What is SQL Injection?
Quick answer
An attack in which malicious input is inserted into a database query, tricking the application into exposing or altering data.
SQL Injection, explained
SQL injection happens when an application builds database queries by directly combining text with user input. If a login form inserts whatever a user types into a query, an attacker can enter specially crafted text that changes the query's meaning, for example making a password check always return true or dumping an entire table of user records.
Despite being well understood for many years, SQL injection still appears in lists of common web vulnerabilities. The main defense is using parameterized queries or prepared statements, which keep user input separate from the query structure. Other safeguards include input validation, using database accounts with minimal privileges, object-relational mapping libraries used correctly, and web application firewalls as an extra layer.
Related terms
SQL
Structured Query Language: the standard language for storing, querying, and managing data in relational databases.
XSSCross-Site Scripting: a web vulnerability that lets attackers inject malicious scripts into pages viewed by other users.
Guides that mention SQL Injection
Cybersecurity
Trending
What Is a Zero-Day Vulnerability? Lifecycle, Examples and Defenses
How a zero-day goes from hidden flaw to public patch, and what defenders can do in the window before a fix exists.
What Is a Firewall and Do Small Businesses Need One?
What a firewall does, the main firewall types from packet filtering to next-generation, and the settings a small office actually needs to configure.