Chapter 3: SQL Injection

Overview

Many Web projects, both large and small, use databases: A database is a convenient tool for data storage. In most cases, databases are accessed using structured query language (SQL). SQL is a universal language suitable for all databases. However, its syntax can be slightly different in different types of database servers.

A vulnerability called SQL source code injection (or, simply, SQL injection) appears when the attacker can embed any data into SQL queries. SQL injection can be crucial for the system, but despite its danger it is one of the most frequent vulnerabilities.