SQL injection

In short: In an SQL injection an attacker smuggles their own database commands into an input field because the application builds input unchecked into a query.

In more detail: A login that assembles the query as text (... WHERE name = ' + input + ') can be tricked with the input ' OR '1'='1. The outcome ranges from bypassing the sign-in to reading or deleting the entire database.

In Depth

• Protection: parameterised queries (prepared statements). Inputs are passed separately from the command and never read as code.
• ORM: Modern frameworks use parameters by default as long as you do not assemble raw text.
• Further measures: minimal database rights, validate input, do not show error messages.
• Testing: security scanners and code review.

See also: OWASP Top 10, XSS (cross-site scripting)