THREAT‑WATCH
Glossary
SQL Injection
An attack that inserts malicious database commands through a web form or input field to access or manipulate a database.
SQL injection exploits web applications that don't properly validate or sanitize user input before passing it to a database query, letting an attacker read, modify, or delete data they shouldn't have access to, sometimes the entire database. It's been on security vulnerability top-10 lists for over two decades because it remains common in poorly coded applications, despite being well-understood and preventable with parameterized queries.