New: EU CAPTCHA – GDPR-compliant bot protection. Try it free for 3 months!
Home>
SQL injection
Example of an SQL injection attack
Retrieving a user by ID from a database is typically done via a REST API:
https://myapi.com/users/123
This input would likely result in a (unparsed) query like this:
SELECT * FROM users WHERE id = 123
If input validation is missing, an attacker can manipulate the URL:
https://myapi.com/users/123;DELETE FROM users WHERE id != 0
The result: All user data will be deleted.
If the attacker has knowledge of the database's data structure, they could gain administrative privileges by adding or updating entries in the database:
https://myapi.com/users/123;UPDATE users SET admin = 1 WHERE id = 456
Further detailed case studies of SQL injection attacks, including code examples, can be found on the OWASP Foundation website.
03
What Types of SQL Injection Are There?
There are several technical variants of SQL injection attacks. Here is an overview of the most important ones.
In-Band SQLi | Error-based | Database error messages provide information about the database structure |
In-Band SQLi | Union-based | The UNION operator combines the results of multiple SELECT queries and returns them in the HTTP response |
Blind SQLi | Boolean-based | No direct output; the attacker infers the result based on true/false responses |
Blind SQLi | Time-based | Response delays reveal database contents |
Out-of-Band SQLi | – | Data is exfiltrated via a separate channel (e.g., DNS) |
In-Band SQL Injection (directly visible)
In-band SQLi involves two main techniques: error-based and union-based. Error-based injection exploits database error messages to gather information about the database structure. Union-based injection combines results from multiple tables using the UNION SQL operator, thereby enabling data extraction and unauthorized access.
Error-based: The attacker sends SQL queries that generate errors and analyzes the database server's error messages. This allows the attacker to obtain information about the database structure. In some cases, error-based SQLi alone is sufficient to compromise an entire database.
Union-based: Union-based SQL injection is an in-band technique that uses the UNION SQL operator to combine the results of two or more SELECT queries and return them as part of the HTTP response.
Blind SQL Injection (not directly visible)
Blind SQL injection is a type of SQLi attack in which the attacker asks the database true-or-false questions and determines the answer based on the application’s response. This attack method is often used when the web application does not return direct database output or error messages, meaning the attacker is acting “blindly.” Instead of reading data directly, the attacker asks the database specific questions and draws conclusions from the application’s behavior. There are two subtypes:
Boolean-based: The attacker sends SQL queries that cause the application to respond differently based on the result (true or false). Depending on the result, the content of the HTTP response either changes or remains the same.
Time-based: Time-based SQLi is an inferential technique in which an SQL query forces the database to wait for a specific period of time before responding. The response time can then be used to draw conclusions about the truth value of the query.
Out-of-Band SQL Injection
Out-of-band SQL injection is a rarely used variant of SQLi in which the attack and data exfiltration occur via two separate communication channels. The attacker injects SQL commands through the normal input channel, but the stolen data is not returned via the HTTP response; instead, it is actively transmitted from the database server to an external server controlled by the attacker, typically via a DNS or HTTP request. This method requires that the database server can initiate outgoing network connections, which is often prevented in well-secured environments.
Want to learn more about our solutions, use cases and best practices for attack defense? In our download area you will find product sheets, fact sheets, white papers and case studies.
Frequently Asked Questions About SQL Injection
SQL injection (SQLi) is a cyberattack in which attackers deliberately inject malicious SQL commands into a web application. The goal is to gain unauthorized access to databases, steal or manipulate sensitive data, or take over entire systems. According to OWASP, SQL injection is one of the most critical security risks for web applications.
About the author
Björn Greif
Senior Editor
About the author
Björn started his career as an editor at the IT news portal ZDNet in 2006. 10 years and exactly 12,693 articles later, he joined the German start-up Cliqz to campaign for more privacy and data protection on the web. It was then only a small step from data protection to IT security: Björn has been writing about the latest trends and developments in the world of cybersecurity at Myra since 2020.