thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

SQL Injection (SQLi)

Injecting malicious SQL into application inputs to read, modify or delete database data or bypass authentication.

Definition

SQL injection occurs when user input is concatenated into SQL queries without parameterization. Variants include in-band (error-based, UNION), blind (boolean, time-based) and out-of-band. Parameterized queries, stored procedures, input validation, least-privilege database accounts and WAFs mitigate it.

Example

Entering ' OR 1=1 -- in a login form to bypass authentication.

Exam tip

Parameterized queries (prepared statements) are the best answer; WAFs are compensating.

Don't confuse it with

Related terms