What Is SQL Injection and Does Your Website Have It?

What is SQL injection and does your website have it?

SQL injection has been the most consistently exploited web vulnerability for over two decades. It was the attack vector in the TalkTalk breach that resulted in a £400,000 ICO fine and exposed the details of 157,000 customers.

What SQL injection actually is

Most websites store information in a database. When a user searches for something, logs in, or submits a form, the website sends a query to that database.

SQL injection happens when an attacker inserts their own database commands into that query. Instead of a normal login attempt, they send code that tells the database to ignore the password check entirely.

What an attacker can do with it

Extract every customer name, email address, phone number, and password hash in your database. Modify or delete data. Bypass login systems. In some configurations execute commands directly on the server.

The attacker rarely announces themselves. Many SQL injection breaches go undetected for months.

Who is at risk

Any website that accepts user input and queries a database — e-commerce sites with search boxes, websites with login forms, booking systems, contact forms, any site with URL parameters like ?id=1.

How to find out if your site is vulnerable

Type a single quotation mark into a form field or URL parameter. A database error appearing on the page strongly suggests vulnerability.

Yrzo AI runs SQL injection scanning as one of its 75+ automated checks. Starting at £149.