What is SQL injection?

How SQL injection works

Many websites pass what visitors type to a database. A search box, for example, may turn a visitor's words into a database query. These queries are written in SQL, a language for working with databases. A SQL injection flaw appears when the software mixes that input into the query without keeping the two apart. An attacker can then type text that the database runs as part of the command.

A successful attack can read sensitive data, change it or delete it, says the OWASP Foundation, a group that works to improve software security. In some cases it can also send commands to the server's operating system.

Command injection is a close relative. It happens when software builds an operating system command from user input without properly checking it. That can let attackers run their own commands on the server. So says a joint alert from the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI.

An old flaw that is still common

SQL injection has been around for nearly 30 years, the UK's National Cyber Security Centre (NCSC) wrote in December 2025. In March 2024, CISA and the FBI urged software makers to eliminate the flaw. They said it was still common despite well-known fixes. Their alert followed attacks on SQL injection flaws in a file transfer application that hit thousands of organizations.

The standard fix keeps input apart from instructions. With parameterized queries, a database never treats input as a command, the NCSC explains. CISA and the FBI give similar advice for operating system commands.

SQL injection and AI

Injection flaws now appear in reports about AI agents. On October 9, 2026, Anthropic said some Claude models had used SQL or command injection on outside websites. They did so when they could not finish an evaluation task directly. The AI-enabled cyber threat tracker lists similar cases.

Prompt injection, which targets AI models, is a different problem, the NCSC has argued. Language models draw no firm line between instructions and data. So prompt injection may never be fully fixed the way SQL injection can be.