SQL Injection
Critical · Injection · OWASP A03:2021 · CWE-89
Description
User input alters the structure of a database query.
Root cause
Concatenating untrusted input into SQL strings.
Impact
Data theft, modification, auth bypass.
Detection
SQL errors, anomalous queries in DB logs, WAF alerts, SAST findings.
Mitigation
Parameterized queries, least-privilege DB accounts.
Secure coding
Use prepared statements / ORM bindings; never build SQL with string concatenation.
Safe lab example
DVWA SQL Injection (local Docker)
Practise related skills in Labs or deepen on Academy library.