Where does the problem come from?#
Many websites keep data in a database and build SQL commands to read it. If the application pastes user input, such as a username, straight into the text of the command, a specially crafted input can change the meaning of the command. This weakness is called SQL injection. The problem is insecure programming, not the database itself.
Why does it matter?#
The consequences can include exposure of user data, modification or deletion of data, and bypassing login. It has been among the most common website weaknesses for years and is still found in old or rushed projects.
The right way in code (for developers)#
The basic principle is to keep data separate from the command:
- Use parameterized queries or prepared statements.
- In WordPress, use the safe built-in functions such as prepare.
- Validate and restrict input.
- Give the application's database account only the access it needs, not everything.
- Don't show database errors to users.
For site owners#
If you use ready-made themes and plugins, the most important thing is to update regularly and avoid cracked or abandoned plugins, because weaknesses are usually found in these. A web application firewall and regular backups are an extra layer.
A note#
This article is purely defensive: the aim is to understand the risk and prevent it in your own code. Testing other people's systems without permission is a crime.