PATCH//NOTES Open the interactive version
← All lessons
Web attacks · Beginner · 4 min

SQL injection

Talk to the database directly through a login box.

What it is

Websites store data in databases and ask for it using SQL queries. If a site pastes your input straight into a query, you can change what the query does. Typing ' OR '1'='1 into a login box might turn 'find this user with this password' into 'find any user at all'. It's one of the oldest web bugs and it still causes major breaches.

See it: How SQL injection turns a login form against its database

  1. Attacker's browser → Website: Username: ' OR '1'='1. Instead of a name, the attacker types text that includes SQL.
  2. Website → Database: SELECT * FROM users WHERE name = '' OR '1'='1'. The site pastes the input straight into its query, so the attacker's text becomes part of the SQL. '1'='1' is always true. Stopped by: Parameterised queries keep input as data, never as code. This is the real fix.
  3. Database → Website: Returns every user. The database does exactly what the changed query asks. Stopped by: A least-privilege database account limits what an injection can reach.
  4. Website → Attacker's browser: Logged in as the first user, often an admin. The site treats the result as a successful login.

Step through the animated diagram in the app.

Real case · 2023

MOVEit Transfer

A SQL injection flaw in this widely used file-transfer product let the Cl0p gang steal data from thousands of organisations in one campaign.

Source: Wikipedia: 2023 MOVEit data breach

How defenders stop it

  • Parameterised queries (prepared statements), always
  • Least-privilege database accounts
  • Input validation as a second layer
  • A web application firewall (WAF) as a safety net

Try it yourself

PortSwigger SQL injection labs (free)

Check yourself

1. What's the real fix for SQL injection?

  1. Blocking the ' character
  2. Parameterised queries
  3. Hiding error messages
  4. Using HTTPS
Show answer

Parameterised queries. Parameters keep data and code separate, so input can never become part of the query.

2. Why does ' OR '1'='1 work against a vulnerable login form?

  1. It makes the query's condition always true, so it matches any user
  2. It deletes the database
  3. It encrypts the query
  4. It guesses the password
Show answer

It makes the query's condition always true, so it matches any user. The input closes the quote and adds OR '1'='1, which is always true, so the query returns users without a valid password.

3. What does a least-privilege database account limit?

  1. How much damage a successful injection can do
  2. How fast queries run
  3. Who can visit the website
  4. How many users can sign up
Show answer

How much damage a successful injection can do. If the website's database account can only read what it needs, an injection can't drop tables or read everything.

Answer them in the app to earn XP.

Next: Cross-site scripting (XSS) →