{
  "slug": "sql-injection",
  "url": "https://www.infinity8labs.com/vulnerabilities/sql-injection/",
  "title": "SQL injection (SQLi)",
  "short": "SQLi",
  "aliases": [
    "Blind SQL injection",
    "Error-based SQL injection",
    "Second-order SQL injection"
  ],
  "summary": "User input is built into a database query as code instead of being passed as data, letting an attacker read, change or delete data and sometimes take over the database server.",
  "cwe": [
    "CWE-89"
  ],
  "owasp": "A03:2021 Injection",
  "typical_severity": {
    "min": "high",
    "max": "critical"
  },
  "updated": "2026-10-14",
  "references": [
    {
      "title": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
      "url": "https://cwe.mitre.org/data/definitions/89.html"
    },
    {
      "title": "OWASP SQL Injection Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Query Parameterization Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Web Security Testing Guide: Testing for SQL Injection",
      "url": "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection"
    },
    {
      "title": "MITRE ATT&CK T1190: Exploit Public-Facing Application",
      "url": "https://attack.mitre.org/techniques/T1190/"
    }
  ],
  "sections": [
    "https://www.infinity8labs.com/vulnerabilities/sql-injection/#overview",
    "https://www.infinity8labs.com/vulnerabilities/sql-injection/#impact",
    "https://www.infinity8labs.com/vulnerabilities/sql-injection/#examples",
    "https://www.infinity8labs.com/vulnerabilities/sql-injection/#remediation",
    "https://www.infinity8labs.com/vulnerabilities/sql-injection/#testing",
    "https://www.infinity8labs.com/vulnerabilities/sql-injection/#references"
  ],
  "related_advisories": []
}