CyberGuard dictionary / Web Application Security
SQL Injection
Also known as SQLi
Injection of untrusted input into a database query so it changes the intended query behavior.
In simple terms
A website accidentally treats a visitor’s text as database instructions.
Technical explanation
The core failure is mixing untrusted values with SQL syntax; parameterized queries keep data separate from executable query structure.
The danger is not a special character by itself; it is application code that lets input change the structure of a database command. Parameter binding and carefully designed query construction preserve that boundary.
Examples in practice
A poorly built login form concatenates the supplied username into a SQL statement.
A developer replaces string-built SQL with a parameterized query and adds a regression test using quote characters. The test confirms the input is treated as a value, not as part of the command.
Why it matters
It can expose, alter, or delete records if database permissions allow it.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.