What is SQL Injection?
SQL injection is a vulnerability that lets an attacker tamper with the database queries your website runs. Almost every dynamic site stores its data, users, posts, orders and passwords, in a database, and it fetches that data using SQL queries. When user input is placed into those queries carelessly, an attacker can inject their own SQL and make the database do things it was never meant to do. SQL injection remains one of the most severe web vulnerabilities precisely because it targets the place your most valuable data lives.
What is SQL injection and why is it so serious?
A successful SQL injection can hand an attacker the keys to your entire database. Depending on the flaw, they may be able to read every record, including hashed passwords and personal data, bypass the login screen entirely, modify or delete content, or in the worst cases gain a foothold on the underlying server. Because the database sits at the heart of most applications, a single injectable query can escalate into a full breach, which is why SQL injection has topped web security risk lists for years.
How SQL injection works
The vulnerability appears when a site builds a SQL query by gluing user input directly into the query text. Imagine a login that looks up a user by the name typed into a form. If that name is inserted into the query as-is, an attacker can type something that is not a name but a fragment of SQL. A classic example is entering a value that always evaluates as true, which turns a check for a specific user into a query that matches everyone and lets the attacker log in without a password. The database is simply doing what the query told it to; the flaw is that the attacker got to write part of that query.
Types of SQL injection
- Classic injection, where the results or database errors are visible to the attacker, making extraction straightforward.
- Blind injection, where nothing is shown directly, so the attacker infers data from how the page responds to true or false conditions.
- Time-based injection, a form of blind attack that reads data by measuring deliberate delays in the database response.
How to prevent SQL injection
The defence is well established and highly effective:
- Use parameterised queries, also called prepared statements, so user input is always treated as data and never as part of the query.
- Prefer a trusted database layer or ORM that parameterises for you rather than building queries by hand.
- Apply least privilege, so the database account your site uses can only do what it genuinely needs.
- Validate input as an extra layer, rejecting values that do not fit the expected shape.
SQL injection on WordPress
WordPress core is well protected against SQL injection, and its database layer provides a prepare method precisely so developers can parameterise queries safely. As with cross-site scripting, the real risk usually comes from plugins and themes that build queries unsafely. Keeping everything current is essential, as explained in our guide on WordPress plugin and theme vulnerabilities, since many disclosed SQL injection flaws are fixed quietly in plugin updates.
How to check your site for SQL injection risk
SQL injection can hide in any input a plugin or custom feature exposes, and testing every one by hand is impractical. Run a security scan with EzyAudit AI and we assess your site for the exposure that leads to injection and other database risks, prioritising anything serious and explaining it clearly. See the full list of checks we run. For an in-depth technical reference, the OWASP SQL injection resource is the standard guide.
SQL injection puts your most sensitive data directly in reach of attackers, but parameterised queries and current software shut it down. Scan your website now to check your exposure.