SQL Injection

Behind almost every website is a database: a digital directory where usernames, passwords, and orders are stored. When you log in, the website sends a request to this directory. This request is a short sentence in a fixed command language, and the name you typed is simply copied straight into that sentence. In an SQL injection, an attacker doesn’t type in a name but instead characters that the website interprets as an additional command. The server executes this command because it cannot distinguish between what is text and what is an instruction. This way, an attacker can grab data without ever knowing a password.

Why a single input field can ruin a company

SQL injection is one of the oldest known attacks on the internet. Even so, it still regularly appears in security reports today. The reason is simple: the flaw isn’t in a product that could be updated, but in custom-written program code. Every new website can contain it all over again.

The damage is often enormous because the database contains everything at once. A successful attack doesn’t yield a single account but potentially millions of records. In several major data leaks of recent years, exactly this vulnerability was the entry point. Affected companies then pay fines under the European General Data Protection Regulation and lose their customers' trust.

On top of that: the attack requires no special equipment. A browser and patience are enough. There are even freely available programs that automatically scan websites for such vulnerabilities. That’s why even small sites that no one considers interesting get attacked.

The trick with the quotation mark

An example makes the principle clear. A login form internally builds a sentence like: Find the user with the name 'Anna'. The quotation marks mark where the entered text begins and ends. If an attacker now types in a quotation mark themselves, they close the text area prematurely. Everything they write after that lands outside the quotation marks and is treated by the server as a command.

A classic addition roughly reads: or true. This makes the condition always fulfilled, and the database simply returns the first user. The attacker is logged in without knowing the password. With more elaborate variants, entire tables can be appended or deleted.

The defense against this has been known for decades and is called a prepared statement. With this, the program sends the command and the input separately to the database. The command structure is fixed in advance, and the input is only ever inserted as a value. A quotation mark is then just a character and no longer an instruction. It’s important to distinguish this from a common misconception: filtering out suspicious words is not enough, because attackers can vary the spelling almost arbitrarily.

From security advisories to AI-generated code

In the news, you usually encounter the term after a data leak. When it’s reported that attackers exploited a vulnerability in a web application, an SQL injection is often behind it. It has also ranked high for years on the well-known list of the most common web security risks, the OWASP Top Ten.

In products, you encounter it indirectly. Web application firewalls are protective systems that intercept suspicious requests before they reach the website. Security tests, so-called penetration tests, specifically search for such vulnerabilities. For developers, modern programming libraries automatically handle the secure separation of command and input.

The topic gains new relevance through AI assistants that write program code. These systems learn from existing code found on the internet, and that code also contains many insecure examples. Studies show that generated code can reproduce such vulnerabilities. Anyone using AI for programming must therefore still review the code.