# What is SQL Injection?

> SQL injection is an injection weakness in which untrusted data alters the structure or meaning of a Structured Query Language (SQL) command.

- Canonical URL: https://yellowcube.eu/glossary/structured-query-language-injection/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It occurs when an application builds database statements by combining command text with attacker-influenced values without preserving a reliable boundary between code and data. A successful attack may read or change data, bypass application checks, or invoke database capabilities available to the application account.

The primary defense is to keep query structure fixed and pass values through parameterized interfaces. Input validation can enforce business expectations, but it does not replace parameterization; database permissions should also limit consequences if another control fails.

### Key points

- **Safe query construction:** Use prepared statements or correctly parameterized database interfaces throughout every data-access path, including background jobs, administrative features, imported data, and indirect inputs.
- **Dynamic query elements:** Parameters often cannot represent table names, column names, or sort directions. Map such choices to a fixed allowlist or redesign the query rather than inserting untrusted text.
- **Consequence reduction:** Give application identities only necessary database privileges, separate roles where practical, protect connection credentials, avoid unnecessary database capabilities, and monitor abnormal query behavior.
- **Important limitation:** Escaping, stored procedures, object-relational mapping, input validation, or a web application firewall does not automatically prevent SQL injection; safety depends on how each query is ultimately constructed and executed.

### Related terms

[Application security](<https://yellowcube.eu/glossary/application-security/>) · [Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Open Worldwide Application Security Project (OWASP) Top 10](<https://yellowcube.eu/glossary/open-worldwide-application-security-project-top-10/>) · [Static application security testing (SAST)](<https://yellowcube.eu/glossary/static-application-security-testing/>) · [Dynamic application security testing (DAST)](<https://yellowcube.eu/glossary/dynamic-application-security-testing/>)

### Sources

[OWASP SQL Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) · [MITRE CWE-89: SQL Injection](https://cwe.mitre.org/data/definitions/89.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.