SQL injection (SQLi) is an attack in which malicious SQL code is slipped into a query that an application sends to its database. When the application fails to properly validate or parameterize user input, the attacker can rewrite the query to read data they should never see, bypass login checks, alter records, or in some setups run commands on the host.
It is one of the oldest web flaws still causing breaches, and it has sat on the OWASP Top 10 of critical web application risks for well over a decade. The reliable fix is not clever input filtering but parameterized queries and prepared statements, which keep user data separated from query logic. A frequent misstep is trusting a client-side check or a single escaped field while leaving other inputs open, since one overlooked parameter is all an attacker needs.
How is SQL injection tested on the CISSP?
SQL injection belongs to Domain 8: Software Development Security. Candidates should understand input validation, why parameterized queries are the primary defense, and how one application flaw can expose the data and systems behind it.
Related terms: Secure Software Development Lifecycle, Vulnerability