SQL injection: what it is and why we test for it

SQL injection is one of the oldest and most damaging web vulnerabilities, and it is a core part of what a penetration test probes for.

It happens when a website builds a database query out of user input without handling that input safely. An attacker types crafted content into a form field, URL or other input, and the site unwittingly treats it as part of a database command. The result can be:

• Reading data the attacker should never see — customer records, passwords, everything in the database.
• Altering or deleting data.
• In the worst cases, gaining a foothold on the server itself.

Our tester probes your site's inputs by hand to see whether any can be manipulated in this way. Injection flaws — SQL, command and related — are explicitly on the test list because a single overlooked input can expose an entire database. The technical report explains any found and how to close them.