SQL Injection (SQLi)

Code injection exploit executing arbitrary database queries through unsanitized input.

Core Principles & Analysis

• Allows unauthorized retrieval of sensitive database contents.
• Can bypass authentication mechanisms completely.
• Prevented using parameterized queries and prepared statements.

Specifications & Metrics

• CWE: CWE-89
• IMPACT: Critical