What Is SQL Injection and Does Your Website Have It?

What is SQL injection and does your website have it?

SQL injection has been the most consistently exploited web vulnerability for over two decades. It appears in the OWASP Top 10 list of critical web application security risks every year. It was the attack vector in the TalkTalk breach that resulted in a £400,000 ICO fine and exposed the details of 157,000 customers.

Despite this, thousands of UK business websites remain vulnerable to it right now.

What SQL injection actually is

Most websites store information in a database. When a user searches for something, logs in, or submits a form, the website sends a query to that database to retrieve the relevant information.

SQL injection happens when an attacker is able to insert their own database commands into that query. Instead of sending a normal login attempt, they send code that tells the database to ignore the password check entirely. Instead of searching for a product, they send a command that extracts every customer record in the database.

The reason it works is that the website takes input from the user and passes it directly to the database without properly checking or sanitising it first.

What an attacker can do with it

SQL injection vulnerabilities allow attackers to extract data — every customer name, email address, phone number, and password hash in your database. In more severe cases they can modify or delete data, bypass login systems entirely, and in some configurations execute commands directly on the server.

The attacker rarely announces themselves. In many cases, SQL injection breaches go undetected for months because no obvious disruption occurs — the attacker simply takes a copy of the data and leaves.

Who is at risk

Any website that accepts user input and queries a database is potentially at risk. This includes e-commerce sites with search boxes, websites with login forms, booking systems, contact forms that look up customer records, and any site with a URL that contains parameters like ?id=1.

How to find out if your site is vulnerable

The basic manual test is to type a single quotation mark into a form field or URL parameter and see whether the page throws a database error. A database error message appearing on the page strongly suggests the site is vulnerable.

Proper testing requires automated tools that generate thousands of injection payloads and observe how the application responds to each one. This is one of the 44 checks that Yrzo AI runs against your website automatically.

How it gets fixed

SQL injection is fixed in the code. The solution is to separate the user's input from the database command rather than combining them into a single string — called using parameterised queries or prepared statements. The fix is not complicated once you know where the problem is.

Why this matters beyond your own business

If your website is breached through SQL injection and customer data is exposed, you are legally responsible under UK GDPR. The ICO does not accept that a developer made a mistake as a defence. The obligation to ensure appropriate technical security measures rests with the business, not the development team.