SQL Injection

What Is Broken and Why

SQL injection arises when applications build SQL queries by concatenating user-controlled strings without parameterization or proper escaping. An attacker who controls part of the query can change its semantics — bypassing authentication, extracting data via UNION or blind techniques, writing files, or executing operating-system commands through database-specific features (xp_cmdshell, UTL_HTTP). The root cause is treating data as code.

Key Signals

• Single quote ' or semicolon ; in a parameter returns a database error or anomalous response
• AND 1=1 returns normal content; AND 1=2 returns empty/different content
• Error messages referencing MySQL, ORA-, MSSQL, PostgreSQL syntax
• ORDER BY N-- incrementing until an error reveals column count
• Delayed response to SLEEP(5) or WAITFOR DELAY '0:0:5'
• Application encodes or strips ' but not -- or /**/