Forest Global Training Partners

Cyber Risks · PortSwigger Research

What is SQL Injection? Tutorial & Examples

Summary: SQL injection is a web security vulnerability that lets an attacker interfere with the queries an application makes to its database, allowing them to view, modify, or delete data they should not access, and in some cases compromise the underlying server or perform denial-of-service attacks. PortSwigger describes common forms including retrieving hidden data via comment sequences such as --, bypassing login by submitting administrator'-- with a blank password, using UNION to append a second SELECT and return usernames and passwords, and second-order (stored) injection where input is safely stored but later handled unsafely.

What's compelling: PortSwigger notes SQL injection has driven many high-profile data breaches causing reputational damage and regulatory fines, and can leave a persistent backdoor that goes unnoticed for an extended period. Its recommended fix, parameterized queries, only works when the query string is a hard-coded constant, so any place where developers judge data trusted case-by-case keeps the exposure open.

Read the original at PortSwigger Research ↗

Topics
Data Breaches
Related