Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition

SQL injection

SQL injection, or SQLi, is an attack on an SQL database where a code or database query is inserted via some form of input from a client to the application. SQLi is one of the oldest vulnerabilities, but still one of the most common and, since SQL-based databases are so common, one of the most dangerous.

The severity of SQL injection attacks is limited by the attacker's skill and imagination, and to a lesser extent, defense in depth countermeasures, such as low-privilege connections to the database server. In general, consider SQL injection a high-impact severity.

Before we can inject SQL, we should have a basic understanding of SQL and also understand database structures.

SQL is considered a fourth-generation programming language ...