<aside> <img src="https://cdn-icons-gif.flaticon.com/11201/11201813.gif" alt="https://cdn-icons-gif.flaticon.com/11201/11201813.gif" width="40px" />

Navigation

**home | writeup**

</aside>

<aside> <img src="https://media2.giphy.com/media/2A4A9kI7YFXC789O7A/giphy.gif?cid=6c09b952nklivxw4l0n1vi70ffpthvq0sgj98kn76brxnr08&ep=v1_gifs_search&rid=giphy.gif&ct=g" alt="https://media2.giphy.com/media/2A4A9kI7YFXC789O7A/giphy.gif?cid=6c09b952nklivxw4l0n1vi70ffpthvq0sgj98kn76brxnr08&ep=v1_gifs_search&rid=giphy.gif&ct=g" width="40px" />

Quote

“The biggest room in the world is the room for improvement“ – Helmut Schmidt

</aside>

<aside> <img src="/icons/table_green.svg" alt="/icons/table_green.svg" width="40px" />

i. Table of Content

</aside>

<aside> <img src="/icons/location_green.svg" alt="/icons/location_green.svg" width="40px" />

</aside>

<aside> <img src="/icons/pen_green.svg" alt="/icons/pen_green.svg" width="40px" />

ii. TL;DR

</aside>

<aside> 💡

SQL injection is a critical security vulnerability where attackers manipulate database queries by injecting malicious SQL code through user input fields, potentially leading to unauthorized data access, database manipulation, and system compromise. Prevention methods include using prepared statements, validating inputs, implementing least privilege principles, and regular security testing to maintain database integrity and protect sensitive information.

</aside>

<aside> ❓

What is SQL Injection?

</aside>

SQL Injection (SQLi) is a type of security vulnerability that occurs when an attacker manipulates an application's database queries by injecting malicious SQL code through user input fields. This attack vector allows unauthorized access to sensitive data, modification of database content, or even complete system compromise.

<aside> 💡

How SQL Injection Works

</aside>

When an application fails to properly validate or sanitize user input, attackers can insert SQL commands that get executed by the database. Here's a simple example:

-- Original query
SELECT * FROM users WHERE username = 'input' AND password = 'password'

-- Malicious input: ' OR '1'='1
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'password'

In this example, the injected code changes the query's logic to always return true, potentially bypassing authentication.

<aside> 💉

Common Types of SQL Injection

</aside>