SQLi

An attack that injects malicious SQL through unsanitized input.

SQL injection inserts malicious SQL through unsanitized input so the database executes attacker intent, allowing data exfiltration, authentication bypass, or destructive commands. Variants include error based, union based, blind, and time based techniques that infer data from application behavior, and it remains a top web application risk. The most effective control is parameterized queries that separate code from data, reinforced by least privilege and stored procedure hygiene. Contrast SQLi, which targets the backend database, with cross site scripting, which targets the browser.