How SQL Injection Works
IntermediateSQL injection is a vulnerability where an attacker inserts malicious SQL through user input that an application concatenates directly into a query. Because the input becomes part of the query text, the attacker can change what the query does — reading other users data, bypassing login, or destroying tables. It remains one of the most damaging web vulnerabilities. The definitive fix is parameterized queries (prepared statements), which keep data separate from code so input can never alter query structure.
Think of a fill-in-the-blank form that becomes commands
Imagine a form letter: "Fetch the record for [NAME]." If the clerk blindly reads whatever is written in the blank as instructions, a mischievous person could write "Nobody; also shred every file." Because the clerk cannot tell the intended blank from injected commands, disaster follows. SQL injection is exactly this: user input written into the blank is treated as executable query, not just data. Parameterized queries tell the clerk "the blank is only ever a name, never a command."
Step by Step
Key Concepts
Query Concatenation
Building SQL by string-joining user input into the query. This mixes data with code, which is the root cause of SQL injection — the database cannot tell intended values from injected SQL.
Parameterized Queries
Prepared statements that send the SQL and its parameters separately. Placeholders are always bound as data, never interpreted as SQL, which makes injection impossible by design.
Blind SQL Injection
Extracting data when the app shows no direct query output, by inferring answers from application behaviour — different responses or timing delays — one question at a time.
Least Privilege
Giving the application database account only the permissions it needs. If injection occurs, a limited account cannot drop tables or read unrelated data, containing the damage.
Key Facts
- The single definitive fix is parameterized queries (prepared statements) — they separate data from code so input can never alter the query structure.
- Escaping input by hand is error-prone and not a reliable defence; always use parameterization or an ORM that does it for you.
- SQL injection has topped web-vulnerability lists for years and can lead to full data breaches, which is why it is a staple of security interviews.
Real-World Applications
Securing a login form
A login that concatenates the username and password into SQL is trivially bypassed with ' OR '1'='1. Rewriting it with a parameterized query so the inputs are bound as values eliminates the vulnerability entirely.
Safe search and filters
A product search that inserts a user search term into SQL is a classic injection point; using a prepared statement (or an ORM query) ensures the term is only ever matched as data, never executed.
Frequently Asked Questions
What is SQL injection?
SQL injection is a vulnerability where an attacker inserts malicious SQL through user input that the application concatenates directly into a database query. Because the input becomes part of the query text, the attacker can change what the query does — bypassing authentication, reading data they should not see, or modifying and deleting records. It is one of the most damaging and long-standing web security flaws.
How do you prevent SQL injection?
The definitive prevention is parameterized queries (prepared statements), which send the SQL and the input data separately so placeholders are always treated as values and never as executable SQL. This makes injection impossible regardless of what the user enters. Additional layers help too: input validation, least-privilege database accounts, not exposing raw database errors, and using ORMs that parameterize by default. Hand-written escaping is not a reliable substitute.
What is a parameterized query and why does it stop injection?
A parameterized query (prepared statement) defines the SQL with placeholders and then binds the user input to those placeholders separately, rather than concatenating input into the query string. The database treats the bound values strictly as data, never parsing them as part of the SQL command. So even an input like ' OR '1'='1 is searched for as a literal string and cannot alter the query structure — which is exactly why it prevents injection.
What is blind SQL injection?
Blind SQL injection is a variant used when the application does not display query results or database errors directly. Instead of reading data from the response, the attacker infers it from the application behaviour — for example, whether a page loads differently for a true versus false condition (boolean-based), or how long a response takes when a query includes a deliberate delay (time-based). It is slower but can still extract data one inference at a time.