SQL Injection

Spec & Goals 3 min

AQA Spec 3.6.1.1 — SQL injection (a cyber security threat)

By the end of this lesson you can:

1. Describe what an SQL injection attack is.
2. Explain how entering SQL into an input box can damage a database.
3. State how to defend against it (validation / sanitising input).

Warm-Up 5 min

Websites send your input to a database using SQL commands (you'll learn SQL fully in Unit 7). If the site doesn't check that input carefully, an attacker can sneak in their own SQL.

Quick starter

A login box expects a username. What might go wrong if someone types ' OR '1'='1 instead of a name?

Key Concept — injecting commands 14 min

SQL injection is entering SQL commands into an input box (e.g. a login or search field) on a website, so that the malicious SQL runs against the database.

Why it works

The website builds an SQL query by joining fixed SQL with whatever the user typed. If the input isn't checked, the user's text becomes part of the command.

A normal login might build:

SELECT * FROM users
WHERE username = 'aisyah' AND password = 'p@ss';

But if the attacker types ' OR '1'='1 as the username, the query can become:

SELECT * FROM users
WHERE username = '' OR '1'='1' AND password = '';

Because '1'='1' is always true, the WHERE test passes and the attacker may be let in, or shown every user's record.

How to defend against it

• Validate / sanitise input — reject or escape characters like ' and SQL keywords.
• Parameterised queries — keep the user's input as data, never as part of the command.
• Least privilege — the website's database account can only do what it needs.

Worked Example — read the attack 12 min

Problem: A search box runs SELECT * FROM products WHERE name = '[input]';. Show what a malicious input could do, and how to stop it.

Attacker types:

'; DROP TABLE products; --

The query the site builds becomes:

SELECT * FROM products WHERE name = '';
DROP TABLE products; --';

• The first statement runs harmlessly.
• DROP TABLE products; then deletes the whole products table.
• -- comments out the rest, so the query doesn't error.

Defence: validate/sanitise the input (reject the ' and ; / use a parameterised query), so the text is treated only as a product name to search for — never as SQL.

Try It Yourself 12 min

📝 Exam Practice 10 min

Recap & Key Terms 3 min

SQL injection puts SQL code into an input box so the database runs it. It works when a site trusts unchecked input, and can read, change or delete data. Defend by validating/sanitising input and using parameterised queries so input is treated as data, not commands.

SQL injection

Entering SQL into a website input field so the database runs it, to view, change or destroy data.

Input validation

Checking that input is acceptable before use — a key defence against injection.

Sanitising input

Removing or escaping dangerous characters so input cannot be run as SQL.

Parameterised query

A query where user input is passed as data, never as part of the SQL command.

Homework 1 min

Task (≤ 15 min): A canteen ordering site lets students type their name, which is dropped straight into an SQL query. Explain the risk and recommend two fixes.