The DB query is built by concatenating user text.
**Category:** [Web ยท OWASP Top 10](/en/glossary) ๐ฏ **Trench** โ The DB query is built by concatenating user text. You inject malicious SQL and the DB runs it as if it came from the backend. ๐ **Kill chain** โ Prerequisite: vulnerable parameter. Next: data extraction โ auth bypass โ RCE via `INTO OUTFILE` (MySQL) or `xp_cmdshell` (MSSQL) โ system escalation. ๐ก **Defensive footprint** โ SQL errors in HTTP response, anomalous response times (blind SQLi), multiple requests with `' OR 1=1` or variants. WAF detects basic signatures trivially. โ ๏ธ **False friend** โ Running `sqlmap` with default flags in production. Generates **thousands** of requests, fires the WAF in seconds and bans your IP within the first minute. ๐ก๏ธ **Remediation** โ Prepared statements **always**. Never concatenate. ORM used properly (no `raw()`). ```php theme={null} // VULNERABLE $sql = "SELECT * FROM users WHERE email = '" . $_POST['email'] . "'"; // SAFE (PDO) $stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?"); $stmt->execute([$_POST['email']]); ``` *** โ [Back to the full glossary](/en/glossary) *Last updated: 2026-06-11*