What is SQL Injection?#

SQL injection occurs when user input changes the structure of a SQL query. Instead of being treated as data, the input is interpreted as SQL code.

Why It’s Still a Big Risk#

Many applications still build SQL strings manually. Even one unsafe query in a large system can open the door to attackers. SQL injection is common in:

• Legacy PHP or Java apps
• Internal dashboards with weak input validation
• APIs that trust JSON fields too much
• Admin panels and reporting tools

Basic Example#

Vulnerable Code (PHP):

1
$username = $_GET['username'];
2
$query = "SELECT * FROM users WHERE username = '$username'";

Attack Input: ' OR '1'='1

Resulting Query:

1
SELECT * FROM users WHERE username = '' OR '1'='1'

This makes the WHERE clause always true, returning all users.

More Vulnerable Patterns#

1
$user = $_POST['user'];
2
$pass = $_POST['pass'];
3
$query = "SELECT * FROM users WHERE user='$user' AND pass='$pass'";

1
SELECT * FROM orders WHERE id = $id

1
SELECT * FROM products WHERE name LIKE '%$search%'

Types of SQL Injection#

1
' UNION SELECT 1, database(), version()--

1
' UNION SELECT username, password FROM users--

1
' AND 1=1--
2
' AND 1=2--

1
' AND SLEEP(5)--

Exploitation Examples (High-Level)#

1
' OR '1'='1'--

1
' UNION SELECT version(), null, null--

1
' UNION SELECT schema_name, null, null FROM information_schema.schemata--

1
' UNION SELECT table_name, null, null FROM information_schema.tables WHERE table_schema='appdb'--

1
' UNION SELECT column_name, null, null FROM information_schema.columns WHERE table_name='users'--

1
' UNION SELECT username, password FROM users--

1
'; UPDATE users SET role='admin' WHERE user='attacker';--

1
'; DELETE FROM logs;--

Safe Coding Examples#

1
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
2
$stmt->execute([$username]);

1
cursor.execute("SELECT * FROM users WHERE username = ?", (username,))

1
const [rows] = await conn.execute(
2
  "SELECT * FROM users WHERE email = ?",
3
  [email]
4
);

1
PreparedStatement stmt = conn.prepareStatement(
2
  "SELECT * FROM users WHERE id = ?"
3
);
4
stmt.setInt(1, userId);

1
using var cmd = new SqlCommand(
2
  "SELECT * FROM users WHERE username = @u", conn
3
);
4
cmd.Parameters.AddWithValue("@u", username);

Example: Safe Search Endpoint (Python)#

1
@app.get("/search")
2
def search(q: str):
3
    sql = "SELECT id, name FROM products WHERE name LIKE ?"
4
    return db.execute(sql, ("%" + q + "%",)).fetchall()

The query structure is fixed, and user input is treated as data only.

Example: Validation + Parameterization#

1
if (!ctype_alnum($username)) {
2
    die("Invalid input");
3
}
4
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
5
$stmt->execute([$username]);

Validation reduces risk, but parameterization is the real protection.

Common Mistakes That Reintroduce SQLi#

• Building SQL strings for dynamic sorting without a whitelist
• Using string concatenation for IN clauses
• Trusting values from cookies or JWT claims
• Running admin queries from user-controlled input

Secure Patterns for Dynamic Queries#

1
$allowed = ['name', 'created_at'];
2
$sort = in_array($sort, $allowed, true) ? $sort : 'name';
3
$sql = "SELECT * FROM products ORDER BY $sort";

1
ids = [1, 2, 3]
2
placeholders = ",".join(["?"] * len(ids))
3
sql = f"SELECT * FROM orders WHERE id IN ({placeholders})"
4
cursor.execute(sql, ids)

Detection and Testing#

• Static analysis to find risky query building
• Dynamic testing and fuzzing on input fields
• Runtime monitoring for SQL errors and unusual patterns
• Security reviews for database access layers

Prevention Strategies#

1. Always use prepared statements or ORM parameterization.
2. Validate and normalize input.
3. Apply least privilege for database accounts.
4. Log and monitor suspicious database errors.
5. Keep database and framework components updated.

Real-World Impact#

SQL injection can cause:

• Exposure of sensitive data
• Authentication bypass
• Data loss or corruption
• Service disruption

Even a single vulnerable query can lead to serious incidents, so prevention must be systematic.

Learning Path#

1. Learn SQL basics and query logic.
2. Practice in safe labs and training platforms.
3. Understand how different databases behave (MySQL, PostgreSQL, MSSQL, SQLite).
4. Study parameterized queries in your language.
5. Learn secure design patterns for dynamic queries.

Summary#

SQL injection is preventable. Never concatenate untrusted input into SQL queries. Always use prepared statements, validate inputs, and enforce least privilege. A secure database layer is not optional in modern applications.

Simple Advice

Treat every input as malicious until proven otherwise. Parameterized queries and strict validation remove most SQLi risks.

1
X : http://x.com/cat0x01
2
github : http://github.com/cat0x01