What Is SQL Injection (SQLi)?
Definition
SQL injection (SQLi) is an attack where someone types database commands into a website's input, such as a search box, login form, or URL parameter, and the site runs them. OWASP defines it as "insertion or 'injection' of a SQL query via the input data from the client to the application."
How It Works
Websites talk to their databases in SQL. A safe site treats whatever a visitor types as plain data. A vulnerable site pastes the visitor's text straight into its SQL query, so carefully crafted input changes what the query does.
OWASP notes that a successful SQL injection "can read sensitive data from the database, modify database data," run administrative operations on the database, and in some cases issue commands to the operating system. For a WordPress site, the database holds user accounts and password hashes, orders, form entries, and site settings, so read access alone is serious and write access means a new admin account.
The fix has been known for decades: parameterized queries (prepared statements), which keep data and commands separate. In WordPress, plugin developers use $wpdb->prepare() for this. CISA and the FBI, in a 2024 Secure by Design alert, noted that "despite widespread knowledge and documentation of SQLi vulnerabilities over the past two decades, along with the availability of effective mitigations, software manufacturers continue to develop products with this defect."
Site owners cannot rewrite plugin code, so their defenses are keeping plugins updated, removing abandoned ones, using a WAF with SQLi rules, and limiting the database account to the permissions WordPress needs.
Real-World Example
In August 2009, federal prosecutors in New Jersey indicted Albert Gonzalez and two co-conspirators over five corporate data breaches, including Heartland Payment Systems, 7-Eleven, and Hannaford, with over 130 million credit and debit card numbers stolen. The Justice Department said the method of entry "consisted of what is known as a SQL-injection attack, which is an attack that exploits security vulnerabilities in elements of a computer that receives user input." Once inside, the group installed "sniffers" to capture card data in real time.
Why It Matters for a Small Business
SQL injection is old, but it keeps appearing in WordPress plugins and in the business software small companies rely on. The CISA and FBI alert was written after an SQLi flaw in a file transfer product "impacted thousands of organizations." For a small business, one injectable form can expose every customer record in the database, trigger breach notification duties, and give attackers a foothold for further compromise. A WAF and fast updates matter because the business cannot see or fix the plugin code itself.
How to Spot It / How DTS Handles It
Warning signs: database error messages showing on public pages, odd characters such as quotes and UNION SELECT in access logs, new admin users, unexpected changes to options or posts, and plugins with SQLi advisories that have not been updated.
DTS keeps plugins patched, removes unused and abandoned ones, restricts database privileges, and reviews logs for injection attempts. DTS can also help with turning on WAF rules for SQL injection. See our WordPress maintenance service.
Related Terms
- Plugin vulnerability: where most WordPress SQLi bugs live.
- Web application firewall (WAF): SQLi filtering at the edge.
- Abandoned plugin: code that will never get a fix.
- Cross-site scripting (XSS): another injection flaw.
- CWE: SQL injection is CWE-89.
- CVE: how specific SQLi flaws are tracked.
- Card skimmer (Magecart): another way card data is stolen from websites.
Sources
- OWASP, SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
- CISA and FBI, Secure by Design Alert: Eliminating SQL Injection Vulnerabilities in Software (March 25, 2024): https://www.cisa.gov/resources-tools/resources/secure-design-alert-eliminating-sql-injection-vulnerabilities-software
- U.S. Attorney's Office, District of New Jersey, Three Men Indicted for Hacking into Five Corporate Entities, including Heartland, 7-Eleven, and Hannaford, With Over 130 Million Credit and Debit Card Numbers Stolen (August 17, 2009): https://www.justice.gov/archive/usao/nj/Press/files/pdffiles/2009/gonz0817%20rel.pdf
Last updated October 14, 2026.