SQL injection

SQL injection happens when an application builds database queries by joining user input directly into SQL text. An attacker who enters crafted input can change the meaning of the query, for example to return every customer record instead of one, or to bypass a login check.

It is one of the oldest web vulnerabilities and still appears regularly, especially in custom-built portals, older content management plug-ins and internal tools that were never meant to face the internet. The OWASP Top 10 groups it within the broader Injection category.

The fix is well known: use parameterized queries or prepared statements, validate input, apply least privilege to database accounts, and keep frameworks and plug-ins updated. A web application firewall can block common attack patterns as an extra layer, but it does not replace secure code.

For a Canadian business running a customer portal, booking system or e-commerce site, a web application penetration test is the most reliable way to find SQL injection and similar flaws before attackers do.