SQL injection

SQL injection is an attack in which malicious commands are entered into a website or application's input fields to trick its database into revealing, changing or deleting data.

Many websites and business applications store information in databases that use a language called SQL. If an application does not properly handle what users type into forms, search boxes or web addresses, an attacker can insert database commands that the system then runs. This can expose customer lists, passwords or payment information, or let the attacker modify records.

SQL injection is a long-known weakness, yet it still appears in custom-built websites, older content management plugins and in-house tools. For an Alberta business with an online store, client portal or booking system, a successful attack could lead to a data breach requiring notification under PIPA.

Practical tip: if you have a custom web application, ask your developer whether it uses parameterized queries and how it validates input. Keep website platforms and plugins updated, remove ones you no longer use, consider a web application firewall and include your public web applications in vulnerability scanning or penetration testing.