SQL Injection, sometimes abbreviated as SQLi, is a type of vulnerability where an attacker uses a piece of Structured Query Language (SQL) code to manipulate a database and gain access to potentially important information. It is one of the most widespread and threatening types of attacks, as it can potentially be used to harm any web application or any website that uses an SQL database.

• Authentication bypass
• Drifting/theft of data
• Modification or corruption of data
• Deleting data
• Execute arbitrary code
• Access to the root level of the system

Successful SQL injections can be disastrous for any organization or individual. Once sensitive data is compromised in an attack, full recovery can be difficult or impossible.

Databases are often the target of an injection via an application, e.g. a website that requests user input and searches a database for that input, but they can also be direct.

An SQL injection is the most common attack a developer is bound to experience. A single query can compromise a whole application. In an SQL injection attack, the attacker tries to alter the data written to the database via malicious queries.

A code injection attack takes advantage of a computer bug caused by processing invalid data. The attacker inserts (or injects) code into the vulnerable computer program and modifies its execution. Successful code injections can have serious consequences.

Code injection attacks follow a similar pattern of manipulating web application languages interpreted on the server. Typically, a code injection vulnerability consists of improper input validation and dynamic and dangerous user input evaluation.