What is a SQL injection attack?

SQL injection is a code injection technique, that is used to attack data-driven applications, that has

malicious SQL statements inserted into an entry field for execution. For instance, to dump the database contents to the attacker.

SQL injection usually exploit a security vulnerability in an application's software, let's say, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed.

SQL injection is mostly known as an attack vector for websites but can be used to carry out attack on any type of SQL database.

The SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.