What it is#
happens whenever untrusted input reaches a SQL statement without parameterisation. The attacker supplies values that break out of the intended literal and extend the statement — classic techniques include union-based reads, error-based extraction, boolean blind probes, and time-based blind probes using database-specific delay primitives.
Why it matters#
The database holds the application’s most valuable state. A single in an authentication flow can drop a user table, bypass login entirely, or pivot into file-read primitives on drivers that support them. Historical breaches at the scale of hundreds of millions of records have been at their root cause.
Mitigation direction#
Use parameterised queries everywhere. ORMs help, but raw queries still appear in migrations, reporting, and admin tooling. Add input validation as defence-in-depth, not primary defence. Least-privilege database roles prevent a successful from reaching tables the application should never touch; a webhook-only service should not hold DDL rights.