What is SQL Injection? A Beginner’s Guide
SQL injection (SQLi) is one of the oldest and most common web vulnerabilities. Here is how it works, in plain English.
The idea
Websites often keep data, such as users and orders, in a database and talk to it using a language called SQL. If a website builds a SQL query by pasting in text typed by the visitor, a visitor can type SQL instead of normal text and change what the query does.
A simple example
Imagine a login form where the code builds this query:
SELECT * FROM users WHERE name = '[what you type]' AND password = '[what you type]'The developer expects a name. But if the name field is treated as code, an attacker can type input that turns the condition into one that is always true, and the site may log them in without a password.
Why it is dangerous
- Attackers can read private data such as customer details.
- They may modify or delete records.
- In bad cases, they can take over the server.
How developers prevent it
- Parameterised queries (prepared statements): the database treats user input only as data, never as code.
- Input validation: accept only the formats you expect.
- Least privilege: the website’s database account should only do what the site needs.
- Keep software updated and use a web application firewall as an extra layer.
Practice legally. Never test for SQL injection on a website you do not own or have permission to test. Safe practice labs are coming on our WAPT labs page.
Want to learn this hands-on with a trainer? Explore our Ethical Hacking course in Delhi.