SQL Injection
A code injection technique that exploits security vulnerabilities in an application's database layer by inserting malicious SQL statements into input fields.
Definition
SQL injection (SQLi) occurs when user input is incorrectly filtered or not strongly typed and unexpectedly executed as part of an SQL command. Attackers can use SQLi to bypass authentication, access or modify data, execute admin operations, and even take control of the database server. It remains one of the most common and dangerous web vulnerabilities, ranked #3 in OWASP Top 10.
Warum es wichtig ist
SQL injection has been responsible for major data breaches affecting millions of users. The 2017 Equifax breach exposed 147 million records due to a related vulnerability. Prevention requires parameterized queries, input validation, and tools like diffray that detect SQLi patterns in code reviews.
Beispiel
A login form concatenates user input directly into SQL: "SELECT * FROM users WHERE username='" + input + "'". An attacker enters "' OR '1'='1" to bypass authentication and access all user accounts.