DB.
Courses

SQL Injection Attacks
OSCP · Chapter 7

SQL Injection Attacks

SQL injection happens when untrusted input is concatenated directly into a database query instead of being passed as a parameter. It remains one of the most damaging web vulnerabilities because it can expose or modify an entire database.

Key concepts

  • Classic in-band injection: the query result (or error) is visible directly in the response.
  • The only reliable fix is parameterized queries / prepared statements — never string-concatenate user input into SQL.
  • Even with parameterized queries, dynamic table/column names or ORDER BY clauses need allow-list validation since they cannot be bound as parameters.
  • Least privilege matters: a database account used by a web app should never have admin rights over the whole server.

Example

-- Vulnerable (never do this):
query = "SELECT * FROM users WHERE name = '" + input + "'"

-- Safe (parameterized):
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE name = ?");
stmt.setString(1, input);

Try it yourself

On a lab target (e.g. DVWA's SQLi module), try the classic `' OR '1'='1` probe in a login form to see how the query's logic changes, then look at the server code to see exactly why concatenation was unsafe.

ReferenceSearch video walkthroughs

@ Daniel Burlacu