💉

SQL Injection via HTTP

Complex

Free preview · 2 of 5 steps

SQL injection: untrusted input becomes code

SQL injection happens when user-supplied input is concatenated directly into SQL queries. The input becomes part of the SQL command — the attacker can craft input that changes the query's logic.

This is consistently the #1 or #2 vulnerability on the OWASP Top 10. Network-level: the attack travels as an HTTP request; the SQL query executes on the backend database.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step