SQL injection

SQL injection is an attack where text typed into a form or web address is slipped into the database as a command, letting the attacker read or change data. The database cannot tell the difference between what the developer meant and what the attacker added.

What is SQL injection?

It happens when code builds a database query by pasting text from a form, a URL or a cookie straight into it.

Most dynamic sites keep their content and users in a database and talk to it in a language called SQL. A search box, for example, might turn the visitor’s word into a query like “find posts where the title contains this word”. If the code simply glues the word into the query, a visitor can type something that closes the query early and adds a new instruction of their own.

The fix in code is well known: keep the command and the data apart. With prepared statements, the database receives the command first and the visitor’s input separately, so input is never treated as a command. Flaws arise where this was not done, often in older or custom code.

Where it shows up

Search forms, login forms, filters, sort options, comment forms and any URL parameter that ends up in a query are the usual places. It is not a special trick against one product. It is a mistake that any developer can make, which is why it keeps appearing in vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. lists.

What it means for a PHP or WordPress site

WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. core handles database access with care. The risk is mostly in plugins and themes, especially ones that are no longer maintained, that came from an unknown source or that were written for one client and never reviewed. A WordPress pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. with a known SQL injection flaw is a common reason for a security updateA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem..

The consequences depend on what the database holds. A brochure site with a few pages exposes little. A shop with customer data, or a membership site with logins, has more at stake, and in that case a breach also brings reporting duties. This is general guidance, and we do not turn it into scare numbers.

A concrete example

Think of a plugin that filters a list by a category given in the web address. The code takes the category from the address and puts it in a query. A visitor changes the address so that the category contains extra database instructions. If the plugin does not separate input from commands, the database runs those instructions too. The maker’s fix changes the plugin to use prepared statements, and your fix is to install that update. Related attacks, such as cross-site scriptingCross-site scripting (XSS) is an attack that sneaks a harmful script into one of your pages, so it runs in your visitors' browsers as if you had placed it., work against visitors’ browsers instead of the database.

When to act

Update plugins and themes when the maker’s changelog mentions SQL injection or “database query” fixes, and remove plugins you no longer use. Keep database passwords out of reach and give the site’s database account only the rights it needs. If a plugin is abandoned, replace it.

The smaller the amount of code that runs a query when a page is viewed, the smaller the attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server.. A static websiteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes. has no database at that moment, which removes this class of attack for the pages themselves. If you suspect misuse, or the site shows odd content or unknown users, ask us to fix WordPress issues. If you want to move away from this kind of exposure, see our work on a WordPress to static site move.