SQL injection
Manipulating an application's database query by supplying input the application fails to handle safely.
When user input is concatenated into a query rather than parameterized, an attacker can alter the query's meaning: reading other users' records, bypassing authentication, or extracting the entire database.
It is decades old, entirely preventable with parameterized queries, and still found regularly in older applications and hastily built internal tools.
Where this comes up
SQL injection sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
OWASP Top 10 A widely referenced list of the most critical web application security risks, updated periodically. Web application penetration test Testing focused on a specific application, its logic, authentication, and handling of user input. CWE A classification of the underlying types of software weakness, describing categories rather than specific instances.