critical
Security Vulnerability

SQL Injection

SQL injection allows attackers to manipulate database queries by injecting malicious SQL through user input, potentially accessing or destroying all data.

Scan for This Vulnerability

What is SQL Injection?

SQL injection occurs when user input is concatenated directly into SQL queries without sanitization. Attackers can inject SQL commands to bypass authentication, extract data, modify records, or even gain system access. It remains one of the most dangerous and common web vulnerabilities.

How It Happens

  • String concatenation in SQL queries
  • Not using parameterized queries
  • Trusting user input without validation
  • Dynamic SQL generation from user data

Impact

Complete database compromise

Authentication bypass

Data theft or destruction

Potential server takeover

Regulatory violations (GDPR, etc.)

How to Detect

  • Test inputs with SQL characters (' " ; --)
  • Use SQL injection scanning tools
  • Code review for string concatenation in queries
  • Run VAS to detect potential injection points

How to Fix

Use parameterized queries

Always use parameters instead of string concatenation.

// BAD - vulnerable to injection
const query = `SELECT * FROM users WHERE id = '${userId}'`;

// GOOD - parameterized
const query = 'SELECT * FROM users WHERE id = $1';
const result = await client.query(query, [userId]);

Use an ORM

ORMs like Prisma, Drizzle, or TypeORM handle parameterization.

// Prisma example - safe by default
const user = await prisma.user.findUnique({
  where: { id: userId }
});

Validate and sanitize input

Even with parameterized queries, validate input types.

// Validate ID is a number
const userId = parseInt(req.params.id);
if (isNaN(userId)) {
  return res.status(400).json({ error: 'Invalid ID' });
}

Commonly Affected Platforms

Postgres SecurityMongodb SecurityPlanetscale SecurityNeon SecuritySupabase Security

Is Your App Vulnerable?

VAS automatically scans for sql injection and provides detailed remediation guidance.

Run Security Scan

Related Vulnerabilities

Nosql InjectionCommand InjectionRls Misconfiguration