SQLiSQL Injection
Definition
Injection of malicious SQL into a backend query via unsafe concatenation of user input. Allows reading/modifying the database, and sometimes RCE via xp_cmdshell or load_file.
Still top 3 OWASP despite 25+ years of awareness — because any new view with a misused ORM or a hidden raw query reintroduces it. Variants: in-band (UNION, error-based), blind (boolean, time-based), out-of-band (DNS exfil).
Impact: full DB read (PII, hashes), auth bypass (login OR '1'='1'), data modification, command execution depending on the engine (MSSQL xp_cmdshell, MySQL FILE privileges).
Defence: parameterised queries (prepared statements). Not 'quote filtering'. Proper ORM use (no .raw()/QueryBuilder with concatenation). Least privilege on the DB user (don't run the web app as DBA).