title: SQL Injection
category: page
slug: sql-injection
sortorder: 0457
toc: False
sidebartitle: SQL Injection
meta: SQL Injection is a web application vulnerability category that can affect both relational and NoSQL databases.


SQL injections are a category of web application security vulnerabilities that 
can affect both [relational databases](/databases.html) and 
[NoSQL data stores](/no-sql-datastore.html).


### SQL Injection resources
* [How security flaws work: SQL injection](https://arstechnica.com/information-technology/2016/10/how-security-flaws-work-sql-injection/)
  is an approachable primer on the history and danger of how unsanitized
  inputs to a database work.

* [Preventing SQL injections](https://tapoueh.org/blog/2018/11/preventing-sql-injections/)
  provides a [PostgreSQL](/postgresql.html) and psycopg2 example for how
  to avoid getting bit by a SQL injection vulnerability.

* [Securing your site like it's 1999](https://24ways.org/2018/securing-your-site-like-its-1999/)
  covers a bunch of common web application vulnerabilities including
  SQL injection.

* [Automating Blind Sql Injection](https://bad-jubies.github.io/Blind-SQLi-1/)
  shows how to use Python to execute SQL injection on the example
  [Damn Vulnerable Web Application](https://github.com/digininja/DVWA)
  project.
