SQL Injection Fundamentals

What is it?

SQL injection happens when an application builds a database query by directly inserting untrusted user input into the query string, instead of treating that input strictly as data. This lets an attacker change the query’s actual logic, not just its data value.

Why should I learn it?

SQL injection has been on the OWASP Top 10 for years because it remains common and severe — it’s one of the most frequently asked “explain this vulnerability” questions in web security interviews.

How it works

A vulnerable login query might be built like this, directly concatenating user input:

SELECT * FROM users WHERE username = '<input>' AND password = '<input>';

If the username field simply accepts ' OR '1'='1, the query becomes:

SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '';

Because '1'='1' is always true, the query’s logic changes entirely — it can return every user row instead of checking credentials at all. The actual fix is parameterized queries (prepared statements), where user input is always treated strictly as data by the database driver and can never change the query’s structure, no matter what characters it contains.

Real-world example

A login form vulnerable to this exact pattern could let an attacker bypass authentication entirely without ever knowing a valid password — which is why input handling, not just “filtering bad words,” is the real fix.

Troubleshooting mindset

If a report claims SQL injection, verify the fix recommendation is parameterized queries, not just “sanitise the input” — input filtering alone is fragile and frequently bypassed, while parameterization removes the vulnerability class entirely.

Common mistake

Do not memorise the definition without connecting it to real engagement practice. Ask: what does this concept mean for what I’m allowed to actually do, and how would I prove I stayed within scope?

Quick recap

• Understand the job of the phase or technique.
• Know where it sits in the overall testing methodology.
• Always tie it back to authorization and scope.
• Connect the topic to the next phase of the engagement.

Interview connection

Explain the concept in simple words first, then connect it to real engagement practice. That is stronger than repeating a tool name.

References & Further Reading

• AddySec original content — written for the Ethical Hacking track to build practical, interview-ready understanding.