SQL Injection

SQL injection is a form of attack where an attacker types SQL code into a web form so that a database runs it as part of its own command. The purpose is to reach data that the attacker should not be able to read, change or delete.

Many websites have a search box or an enquiry form. When you type into one, the page passes your text to a database using SQL, the language used to search and change stored data. A cinema booking site, for example, might send the film name you searched for so the database can return matching showings.

If the website does not check the text that arrives, the database cannot tell the difference between ordinary text and extra instructions. Whatever was typed becomes part of the SQL command and is run. An attacker can use this to view other customers' booking details, change every ticket price to almost nothing, or delete a table of bookings. The website hands the instructions to the database for them, so the attacker needs no account of their own.

Why it is a threat

The attack targets the database behind the website, not the website's appearance. One unchecked box can therefore expose or destroy every record the database holds, which may be far more data than the attacker could reach any other way.

You do not need to be a programmer or write a full SQL query to do this: a short piece of SQL typed into an ordinary form is enough, and the database does the rest.