Skip to main content
Share Your Experience: Take the 2024 Developer Survey

SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution.

SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. Attackers take advantage of the fact that programmers often chain together SQL commands with user-provided parameters, and can therefore embed SQL commands inside these parameters. The result is that the attacker can execute arbitrary SQL queries and/or commands on the backend database server through the Web application.


There is a community wiki on StackOverflow which has some answers to the very common question, "How can I protect myself from SQL injection?" If your question involves PHP and SQL, make sure you have already read this to prevent unnecessary repetition.

An example SQL Injection could be:

"; SELECT credit_cards FROM transactions; --

In which a normal query could transform into malicious code:

SELECT username FROM users WHERE username = "$username";


SELECT username FROM users WHERE username = ""; SELECT credit_cards FROM transactions; --";