In this series of articles, we’ll take you through the OWASP Top 10 — the ten most common, and most dangerous, types of cyber attack. There’s still a lot of confusion about how these techniques actually work and what you can do about them. And when you go looking, you often land on articles the average reader can’t follow. That’s not meant as an insult — there’s simply a shortage of clearly written content on these threats. At Rootsec, we’re here to change that, with easy-to-understand explanations and no avalanche of jargon. We’ll kick off with the question: what is SQL injection?

What is SQL injection?

Ah yes, SQL injection. This one sat at number 1 in the OWASP Top 10 for years, and remains one of the most common and dangerous threats around. (In the current OWASP Top 10, 2021, “Injection” ranks #3 — still firmly at the top of the list.) Why is it so dangerous? Let’s start with the term SQL. It stands for “Structured Query Language” — a language used to store and retrieve data. Think of the details people enter when they register on a web shop: they create an account, and that data goes into an SQL database. The next time they log in, their details are still there. Convenient, of course — but you can probably already see the danger. That database holds an enormous amount of information that a hacker would love to get hold of. And, surprisingly often, they succeed. The way they do it is through an SQL injection.

An SQL injection is a type of cyber attack in which a hacker uses a fragment of SQL code to manipulate a database and gain access to potentially valuable information. The problem is that a huge number of web applications and websites run on an SQL database. You’re starting to see why this one tops the list.

How does SQL injection work?

To keep it simple — which is the whole point — an SQL injection is nothing more than a request sent to a database (of a website or application) with the aim of collecting information or executing certain code. And as you’ll appreciate, “certain code” in this case has very negative consequences for whoever’s on the receiving end. Here’s an illustration:

You’re a member of Facebook, and every time you log in you enter your details — your username and password. When the information you enter matches what’s in the database, you get access to your account. When it doesn’t match, you try again. The problem arises when it’s possible to abuse those input fields and enter something other than expected. A hacker can then send crafted requests to the database, which lets them steal sensitive data (your Facebook credentials!) or even manipulate the website. Not good.

Why is this method so popular? Because it’s remarkably easy. It’s been around for more than two decades, so there’s plenty of information on it — and, to make matters worse, automated SQL injection tools are now simple to find and use. That makes a hacker’s life a lot easier.

In short, a hacker uses certain characters or expressions in a form’s input field so that their input is treated not as plain text, but as an action to be executed.

How to prevent SQL injection

Preventing SQL injection is relatively simple, yet it’s often overlooked. First, installing a WAF (Web Application Firewall) is a smart move. A WAF monitors everyone and everything: if it spots someone injecting strange code into the website, that request is shown the door without ceremony. We still see far too few organisations implementing a WAF — leaving themselves needlessly exposed.

The second option is to use parameterised input. Sounds complicated; it isn’t. It simply means defining, behind the input fields, what may and may not be entered. If you only allow letters and numbers, then other characters often used in SQL injections — such as an asterisk (*) — can’t be submitted. That alone protects you very effectively against SQL injection.

At Rootsec, it has always been our goal to make information security simple — and this series is part of that mission.

Want to know whether your applications are vulnerable to SQL injection? A Rootsec penetration test finds out before an attacker does. Book a free consultation.

Injection flaws are exactly what manual testing is for. Our VAPT service combines scanning with hands-on verification to prove what is genuinely exploitable.