SQL Injection: How and Why It Works
Understand classic, blind, and out-of-band SQLi and why parameterized queries prevent it.
SQL Injection: How and Why It Works is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is SQL Injection?
SQL Injection (SQLi) occurs when user-supplied input is included in a SQL query without proper sanitization, allowing attackers to manipulate the query logic. It is one of the oldest and most damaging web vulnerabilities.
How SQL Injection Works
A login form queries: SELECT * FROM users WHERE username='INPUT' AND password='INPUT'
If the attacker enters ' OR 1=1-- as username, the query becomes: SELECT * FROM users WHERE username='' OR 1=1--' AND password='...' — which returns all users.
Types of SQL Injection
SQLi variants:
- In-band: results returned directly in the response (classic, error-based)
- Blind Boolean: no direct output; infer data from true/false responses
- Blind Time-based: infer data from response delays (
SLEEP(5)) - Out-of-band: data exfiltrated via DNS/HTTP requests
UNION-Based Injection
UNION attacks append results from attacker-controlled queries:
-- Discover number of columns:
id=1 ORDER BY 3--
-- Extract data:
id=1 UNION SELECT username,password,NULL FROM users--Error-Based Injection
Error messages reveal database structure. An attacker inputs data that causes a syntax error, and the resulting error message leaks table names, column names, or database version. Disable verbose error messages in production.
Blind SQL Injection
When there is no visible output, attackers use boolean conditions:
-- If admin exists, page loads normally:
id=1 AND (SELECT COUNT(*) FROM users WHERE username='admin')=1--
-- Time-based:
id=1; IF(1=1) WAITFOR DELAY '0:0:5'--sqlmap: Automated SQL Injection
sqlmap automates SQL injection detection and exploitation. It can dump databases, read files, and even execute OS commands if the DB user has sufficient privileges.
sqlmap -u "http://target.com/page?id=1" --dbs
sqlmap -u "http://target.com/page?id=1" -D webapp -T users --dumpPreventing SQL Injection: Parameterized Queries
The primary defense is parameterized queries (prepared statements). User input is passed as a parameter, never concatenated into the query string:
# Python (safe):
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))
# Node.js (safe):
pool.query("SELECT * FROM users WHERE id = $1", [userId])ORM Protection
Using an ORM (SQLAlchemy, Hibernate, Sequelize) typically prevents SQL injection because queries are built using safe abstractions. However, raw query methods (execute(), query()) with string interpolation bypass ORM protections.
Input Validation and WAF
Additional defenses:
- Validate and whitelist input types (integers, emails)
- Web Application Firewall (WAF) to detect injection patterns
- Least-privilege DB accounts (no DROP, no UNION on read-only queries)
- Stored procedures (reduce exposure but not a complete solution)
SQL Injection Impact
A successful SQL injection can result in: complete database dump, authentication bypass, data modification or deletion, reading server files (LOAD_FILE), writing web shells, and OS command execution via xp_cmdshell (MSSQL).
Quick Check: SQL Injection
What is the primary defense against SQL injection?
Lesson Recap
SQL injection manipulates database queries via unsanitized user input. Attack types include classic, blind boolean, time-based, and UNION-based. The primary defense is parameterized queries — never concatenate user input into SQL. Use ORMs carefully, apply least-privilege DB accounts, and disable verbose error messages.
Frequently asked questions
Is the “SQL Injection: How and Why It Works” lesson free?
Yes — the full text of “SQL Injection: How and Why It Works” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “SQL Injection: How and Why It Works”?
Understand classic, blind, and out-of-band SQLi and why parameterized queries prevent it. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “SQL Injection: How and Why It Works” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- SQL Injection: How and Why It Works
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Security Misconfiguration and Exposed Services