How SQL Injection Still Powers Major Breaches in 2025
SQL injection is one of the oldest and most documented web application vulnerabilities. It has featured in the OWASP Top 10 consistently for over fifteen years. Prevention techniques are well-understood, development tooling to detect it exists in abundance, and it should, by now, be a problem the industry has largely solved. It has not. SQL injection continues to appear in modern applications and continues to power significant data breaches.
Understanding why it persists and where it tends to appear helps organisations focus their testing and prevention efforts where they will have the most impact.
How SQL Injection Works
SQL injection occurs when an application incorporates user-supplied input into a database query without proper handling. An attacker who controls that input can modify the query’s logic. The classic example is a login form where entering a specific string causes the query to return all users, bypassing authentication. The real-world impact extends well beyond login bypass.
Error-based injection reveals database structure through verbose error messages. Blind injection extracts data a bit at a time through boolean questions, without any visible output. Out-of-band techniques exfiltrate data through separate channels, such as DNS requests, bypassing restrictions on direct output.
Where It Still Appears
Legacy applications built before parameterised query libraries were standard carry SQL injection as an inherited characteristic. They were built in an era when string concatenation was normal practice and have never been fully reviewed. These applications are disproportionately likely to be business-critical, deeply integrated, and difficult to modify.
Custom search functionality, reporting features, and administrative interfaces are commonly overlooked during development security reviews. The main user-facing pages receive attention. The back-end functions used by internal teams or accessed through less obvious routes receive less.
The Impact When It Is Exploited
Successful SQL injection in a production application typically results in full database access. An attacker can extract all stored data: user credentials, personal information, financial records, communications. In databases running with elevated privileges, they can read files from the operating system, execute commands, and use the database server as a pivot point into the internal network.
Web application penetration testing tests for SQL injection across all input vectors in an application, including parameters, cookies, HTTP headers, and JSON payloads. Manual testing is essential alongside automated scanning because some injection points require context and creative input crafting to discover.
Prevention in Modern Development
Parameterised queries and prepared statements are the standard prevention method. They separate SQL code from data, making it structurally impossible for user input to modify query logic. Any application that handles database queries should use them consistently.
Web application firewalls provide a detection and blocking layer but are not a substitute for secure code. WAF rules can be bypassed by encoding variations and unusual payloads. Secure code with a WAF as a secondary defence is a more robust posture than a WAF compensating for insecure code.
Expert Commentary
William Fieldhouse, Director of Aardwolf Security Ltd
“SQL injection should be a solved problem. The prevention techniques are well-understood, the tooling to detect it during development is freely available, and it has featured prominently in security guidance for over two decades. The fact that it keeps appearing in production applications tells us something important about the gap between security knowledge and security practice.”
Testing and Ongoing Assurance
Best penetration testing company for web application testing will cover SQL injection systematically, including in locations that automated scanners miss. Finding and fixing SQL injection before it is exploited avoids the regulatory, reputational, and operational consequences of a data breach.
