Web › Module 1 › Lesson 1
SQL Injection Theory
Understand how untrusted input becomes database commands—and why that breaks everything
Visual · web_developer
Web apps send user input to a database through SQL queries. If the app builds that query as a string, attackers can inject their own SQL.
Opening
Your search box is talking to the database
Every login form, product filter, and “sort by price” dropdown eventually becomes a SQL query on the server. When developers glue user input directly into that query string, they hand attackers a remote control for the database. SQL injection (SQLi) is not magic—it is the app trusting input it should treat as data.
1. What SQL Injection Is
SQL injection happens when user-controlled input is concatenated into a SQL statement without proper separation between code and data. The database cannot tell the difference between the query the developer intended and extra SQL the attacker added. If the app runs it, the attacker can read rows, modify data, bypass login, or—in worst cases—execute commands on the server.
2. A Classic Login Bypass
Vulnerable query (never write this)userpass{username}{password} -- " "# Resulting SQL: SELECT * FROM users WHERE username= --...
userpass{username}{password} --
"
"# Resulting SQL: SELECT * FROM users WHERE username= --...The `--` starts a SQL comment, so everything after it—including the password check—is ignored. The attacker logs in as admin without knowing the password.
3. Why It Still Happens
String building
Old tutorials teach f-strings or + concatenation for SQL.
Legacy code
Apps written before ORMs and prepared statements still run in production.
Hidden inputs
Not just forms—headers, cookies, JSON fields, and URL parameters can all reach SQL.
Lab ethics only
Practice SQLi only on systems you own or have written permission to test—DVWA, WebGoat, or your own local lab. Never probe random websites; that is unauthorized access.
Knowledge Check
SQL injection occurs when:
Multiple choice
Knowledge Check
True or False: SQL injection requires the attacker to know the database password.
True or False
Knowledge Check
Input like admin' -- on a vulnerable login form typically:
Multiple choice