What is SQL injection?
Also called: SQLi
The short answer
SQL injection is an attack that slips database commands into form fields or URLs, letting an attacker read or change data the site never meant to expose.
SQL injection, explained
Parameterised queries, which keep data separate from commands, prevent it completely.
Questions people ask about SQL injection
What is SQL injection?
SQL injection is an attack that slips database commands into form fields or URLs, letting an attacker read or change data the site never meant to expose.
Related terms
A database is organised storage for a site's data, such as users, orders and posts, that the back-end reads and writes on request.
Website securityWebsite security is protecting a site, its data and its visitors from attacks, through HTTPS, updated software, careful input handling, strong logins and backups.
Cross-site scriptingCross-site scripting is an attack where malicious code is injected into a page and runs in other visitors' browsers, stealing sessions or data.
Cross-site request forgeryCross-site request forgery tricks a logged-in user's browser into sending an unwanted request, such as changing an email address, to a site they trust.
Part of the Web Encyclopedia by Apex Flow Digital. Definitions are general knowledge, kept current, with no invented statistics.