SQL injection

How it is used

Often written SQLi. One of the classic web vulnerabilities in the 'Injection' category of the OWASP Top 10. Developers prevent it with parameterised queries (prepared statements) and input validation; pentest reports usually rate it high.

Example sentences

1. The search form was vulnerable to SQL injection, so we switched to parameterised queries.

2. The WAF blocked several SQL injection attempts against the login page.

Common collocations

• SQL injection vulnerability
• blind SQL injection
• parameterised queries
• input validation

Related terms

• cross-site scriptingA web vulnerability in which an application includes untrusted input in a page without proper encoding, so that a harmful script runs in other users' browsers.
• web application firewallA firewall that sits in front of web applications and filters HTTP traffic to block common web attacks such as SQL injection and cross-site scripting.
• vulnerabilityA weakness in software, hardware, a configuration or a process that an attacker could use to cause harm or to gain access they should not have.
• findingA security problem or weakness that is identified and documented during an audit, assessment or penetration test, usually with a severity rating.

This word in other fields

The same English word can have a different meaning in another field:

• SQL injection · Software Engineering
• SQL injection · Web Development
• SQL injection · Databases & SQL

More terms: Threats and Attacks

• threat
• phishing
• exploit
• compromise
• social engineering
• DDoS
• attack surface
• brute-force attack
• privilege escalation
• lateral movement
• man-in-the-middle attack
• threat actor