{ "title": "SQL injection", "seo_title": "SQL injection: definition, example and prevention", "h1": "SQL injection", "description": "SQL injection explained: how poorly handled input hijacks a query, what a WordPress site risks and why $wpdb->prepare() is the right defense.", "lead": "SQL injection is an attack that slips fragments of SQL code into data sent to a website in order to hijack the query the site sends to its database. It can be used to read, modify or delete data, and sometimes to bypass authentication.", "language": "en", "locale": "en-US", "type": "definition", "url": "https://www.wp-masquerade.com/glossary/sql-injection/", "canonical": "https://www.wp-masquerade.com/glossary/sql-injection/", "markdown": "https://www.wp-masquerade.com/glossary/sql-injection/index.md", "json": "https://www.wp-masquerade.com/glossary/sql-injection/index.json", "published": "2026-10-28T08:00:00+00:00", "modified": "2026-10-28T20:06:46+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "SQL injection", "url": "https://www.wp-masquerade.com/glossary/sql-injection/", "markdown": "https://www.wp-masquerade.com/glossary/sql-injection/index.md", "json": "https://www.wp-masquerade.com/glossary/sql-injection/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Injection SQL", "url": "https://www.wp-masquerade.com/fr/definitions/injection-sql/", "markdown": "https://www.wp-masquerade.com/fr/definitions/injection-sql/index.md", "json": "https://www.wp-masquerade.com/fr/definitions/injection-sql/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Inyección SQL", "url": "https://www.wp-masquerade.com/es/glosario/inyeccion-sql/", "markdown": "https://www.wp-masquerade.com/es/glosario/inyeccion-sql/index.md", "json": "https://www.wp-masquerade.com/es/glosario/inyeccion-sql/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "SQL-Injection", "url": "https://www.wp-masquerade.com/de/glossar/sql-injection/", "markdown": "https://www.wp-masquerade.com/de/glossar/sql-injection/index.md", "json": "https://www.wp-masquerade.com/de/glossar/sql-injection/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "SQL injection", "url": "https://www.wp-masquerade.com/it/glossario/sql-injection/", "markdown": "https://www.wp-masquerade.com/it/glossario/sql-injection/index.md", "json": "https://www.wp-masquerade.com/it/glossario/sql-injection/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Injeção de SQL", "url": "https://www.wp-masquerade.com/pt/glossario/injecao-de-sql/", "markdown": "https://www.wp-masquerade.com/pt/glossario/injecao-de-sql/index.md", "json": "https://www.wp-masquerade.com/pt/glossario/injecao-de-sql/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "SQL-injectie", "url": "https://www.wp-masquerade.com/nl/woordenlijst/sql-injectie/", "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/sql-injectie/index.md", "json": "https://www.wp-masquerade.com/nl/woordenlijst/sql-injectie/index.json" } ], "headings": [ { "level": 1, "text": "SQL injection" }, { "level": 2, "text": "How SQL injection works" }, { "level": 2, "text": "What an attacker can get" }, { "level": 2, "text": "For WordPress: $wpdb->prepare()" }, { "level": 2, "text": "How to protect your site as an owner" }, { "level": 2, "text": "Common mistakes" } ], "body": "Almost every dynamic site, WordPress included, stores its content in a database queried with SQL. When code builds a query by pasting in a value received from the visitor, it mixes two things that should stay separate: instructions and data. The attacker takes advantage of this to write instructions where data was expected. MITRE classifies this weakness as CWE-89.\n\n## How SQL injection works\n\nTake code that looks up a post by name by assembling the query by hand:\n\n```\n$sql = \"SELECT * FROM articles WHERE name = '\" . $_GET['name'] . \"'\";\n```\n\nIf the visitor sends `x' OR 'a'='a`, the quote closes the string the developer intended and the rest becomes SQL. The condition is always true: the database returns the whole table. With other payloads, the attacker can extract data from other tables, modify it or delete it.\n\n![Comparison between a concatenated SQL query, where the input x' OR 'a'='a makes the condition always true and returns the whole table, and a query prepared by WordPress, where the input stays a plain value](https://www.wp-masquerade.com/media/2026/10/injection-sql-requete-en.webp)\n\n*A prepared statement keeps SQL code separate from values: the input can no longer change what the query means.*\n\n## What an attacker can get\n\nOWASP sums up the possible consequences of a successful injection:\n\n- reading sensitive data: email addresses, orders, password hashes;\n- inserting, modifying or deleting records, for example giving an account the administrator role, which makes it a path to [privilege escalation](https://www.wp-masquerade.com/glossary/privilege-escalation/);\n- bypassing authentication;\n- in some cases, reading files on the server or sending commands to the operating system, all the way to [remote code execution](https://www.wp-masquerade.com/glossary/remote-code-execution/).\n\nNot every injection displays its result on screen. In so-called “blind” variants, the attacker infers the data piece by piece from differences in responses or timing. It is slower, but just as effective with an automated tool. The [vulnerabilities found in WooCommerce since 2020](https://www.wp-masquerade.com/woocommerce-security-vulnerabilities/) include several SQL injections, and the [All-in-One WP Migration alert](https://www.wp-masquerade.com/all-in-one-wp-migration-cve-2026-19949-probed/) shows that such a flaw gets probed as soon as it is disclosed.\n\n*Video: “Hacking Websites with SQL Injection - Computerphile” (Computerphile)*\n\n## For WordPress: $wpdb->prepare()\n\nHigh-level functions (`WP_Query`, `get_posts()`, `update_option()`…) build their queries themselves. As soon as a plugin writes its own query with the `$wpdb` object, every variable value must go through `$wpdb->prepare()`. Its placeholders are `%s` (string), `%d` (integer), `%f` (float) and, since WordPress 6.2, `%i` for a table or column name.\n\n```\n$ids = $wpdb->get_col( $wpdb->prepare(\n \"SELECT ID FROM {$wpdb->posts} WHERE post_author = %d AND post_status = %s\",\n $author_id,\n 'publish'\n) );\n```\n\n- Don't put quotes around `%s`: the function adds them.\n- For a search with `LIKE`, pass the full string as an argument, after running it through `$wpdb->esc_like()`.\n- Casting IDs with `absint()` before use is an extra safeguard, not a substitute for a prepared statement.\n\n## How to protect your site as an owner\n\n- Apply plugin security updates quickly: you won't be fixing their code yourself.\n- Give the database user only the privileges WordPress needs, to limit the damage of a hijacked query.\n- Put a [web application firewall](https://www.wp-masquerade.com/glossary/waf/) in front of the site: its rules spot the best-known injection payloads and can cover a flaw until it is patched.\n\nWP Masquerade neither detects nor blocks SQL injection: it is not a web application firewall. Hiding WordPress makes it harder to identify installed plugins, which gets in the way of some bots, but it never replaces updating the vulnerable plugin.\n\n## Common mistakes\n\n- Escaping “by hand” with `addslashes()` or character replacements instead of using a prepared statement.\n- Preparing the values but inserting a column name or sort order taken from the request as is: use `%i` or an allowlist.\n- Believing that data safely stored in the database is safe everywhere: on output, it is [cross-site scripting](https://www.wp-masquerade.com/glossary/xss/) you need to prevent, with escaping.\n\n## Related terms\n\n- [XSS (cross-site scripting)](https://www.wp-masquerade.com/glossary/xss/)\n- [WAF (web application firewall)](https://www.wp-masquerade.com/glossary/waf/)\n- [Remote code execution (RCE)](https://www.wp-masquerade.com/glossary/remote-code-execution/)\n- [Privilege escalation](https://www.wp-masquerade.com/glossary/privilege-escalation/)\n- [CSRF (cross-site request forgery)](https://www.wp-masquerade.com/glossary/csrf/)\n\n\n## Sources\n\n- [OWASP : SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n- [MITRE CWE-89 : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)](https://cwe.mitre.org/data/definitions/89.html)\n- [WordPress Developer Resources : wpdb::prepare()](https://developer.wordpress.org/reference/classes/wpdb/prepare/)", "definition": "SQL injection is an attack that slips fragments of SQL code into data sent to a website in order to hijack the query the site sends to its database. It can be used to read, modify or delete data, and sometimes to bypass authentication.", "group": "Web security", "aka": [ "SQLi", "SQL injection attack", "CWE-89" ], "related": [ { "title": "XSS (cross-site scripting)", "url": "https://www.wp-masquerade.com/glossary/xss/", "markdown": "https://www.wp-masquerade.com/glossary/xss/index.md" }, { "title": "WAF (web application firewall)", "url": "https://www.wp-masquerade.com/glossary/waf/", "markdown": "https://www.wp-masquerade.com/glossary/waf/index.md" }, { "title": "Remote code execution (RCE)", "url": "https://www.wp-masquerade.com/glossary/remote-code-execution/", "markdown": "https://www.wp-masquerade.com/glossary/remote-code-execution/index.md" }, { "title": "Privilege escalation", "url": "https://www.wp-masquerade.com/glossary/privilege-escalation/", "markdown": "https://www.wp-masquerade.com/glossary/privilege-escalation/index.md" }, { "title": "CSRF (cross-site request forgery)", "url": "https://www.wp-masquerade.com/glossary/csrf/", "markdown": "https://www.wp-masquerade.com/glossary/csrf/index.md" } ], "sources": [ { "title": "OWASP : SQL Injection", "url": "https://owasp.org/www-community/attacks/SQL_Injection" }, { "title": "MITRE CWE-89 : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)", "url": "https://cwe.mitre.org/data/definitions/89.html" }, { "title": "WordPress Developer Resources : wpdb::prepare()", "url": "https://developer.wordpress.org/reference/classes/wpdb/prepare/" } ], "format": "application/json" }