+1 coinfor reading to the end
+1
Home / Glossary / SQLi
Glossary · Security

SQLi

SQL Injection

In plain language

An attack that sneaks database commands into a web form to read or change data it should not.

The metaphor

Like writing extra instructions on an order slip so the kitchen hands over the entire recipe book.

Going deeper

How it works

  • A form passes your input straight to the database.
  • The attacker types commands in place of a name.
  • The database runs them and returns private records.
  • Developers prevent it with safe query methods.

What can go wrong (example scenario)

A small retailer's online store used an unmaintained plugin. Attackers pulled the customer table through the search box and published it.

In practice
  • A developer reviews forms for the flaw.
  • A host blocks known patterns.
  • A firm updates an old plugin.

A question owners ask

How do I know if my site is exposed?

Keep the site software and plugins updated, and have a developer test any custom forms.

Related terms
AAAAuthentication, Authorization, and AccountingAccount takeoverACLAccess Control ListAdmin accountAESAdvanced Encryption StandardAES-256Advanced Encryption Standards 256-bitAISAutomated Indicator SharingAPTAdvanced Persistent Threat

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →