How does SQL Injection work also when does it occur?

SQL Injection (SQLi)

🔎 What is SQL Injection?

SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database.

• It enables attackers to view data they are not normally authorized to access.
• This may include data belonging to other users, system credentials, or sensitive application data.
• In severe cases, SQLi can escalate to:
  • Full compromise of the underlying server
  • Modification or deletion of data
  • Privilege escalation and account takeover
  • Denial of service attacks

❓ Why Does It Occur?

SQL injection occurs when user input is not validated and is directly embedded into SQL queries.

-- Example: vulnerable case
SELECT * FROM users WHERE username = ' " + input + " ';