SQL Injection Explained: How It Works and How to Prevent It

SQL injection is one of the oldest web vulnerabilities, and it still turns up in real applications. It happens when an application builds a database query by pasting user input into it, so specially crafted input changes what the query does. This guide explains the idea, the main variants and, most importantly, the fix.

How It Works

Imagine a login that builds the query "find the user whose name is X and password is Y" by joining text together. If someone types input containing a quote and extra SQL, the database may read part of their input as instructions instead of data, for example making the password check always true. The flaw is not the database; it is mixing code and data.

What an Attacker Can Do

• Log in as another user without a password
• Read data from other tables, such as customer records
• Change or delete data
• In some configurations, read files or run commands on the server

Main Variants

• In-band, error-based: database errors in the page reveal information
• In-band, UNION-based: the attacker adds their own query and sees its results in the page
• Blind, boolean-based: the page changes slightly depending on whether a condition is true
• Blind, time-based: the attacker makes the database pause and measures the delay
• Out-of-band: the database is made to contact a server the attacker controls

How Testers Find It

Testers look at every place input reaches the server: form fields, URL parameters, cookies, headers and JSON bodies in APIs. They send characters that would break a query and watch for errors, differences or delays, usually in Burp Suite's Repeater. Tools such as SQLmap automate confirmation, but only within scope and agreed limits, because they can send a lot of traffic. Practice only in labs such as DVWA or PortSwigger's Web Security Academy.

How to Prevent It

• Parameterized queries (prepared statements) for every query that uses input. This is the real fix
• Use ORM and query-builder features correctly; raw query functions can reintroduce the flaw
• Give the application's database account only the permissions it needs
• Validate input types and lengths as an extra layer, not the main defense
• Show generic error messages to users and log the details privately

Where It Sits in OWASP

SQL injection belongs to the Injection category, A05 in the OWASP Top 10:2025. Cross-site scripting is a close relative; see XSS explained.

Learning Web Testing

Injection testing is part of our Application Security course, where you find, confirm and report flaws like this in authorized labs, then retest the fix.