SQL injection (SQLi) is a web vulnerability where attacker-controlled input is interpreted as part of a database query, allowing data to be read, changed or bypassed. It happens when an application builds SQL by joining strings instead of using parameters.
Example
A login handler builds this query:
SELECT * FROM users WHERE name = '$name' AND pass = '$pass'Entering admin' -- as the name comments out the password check, so the query returns the admin row. In a CTF the flag is then shown on the admin page, or you extract it with a UNION SELECT from another table.
How it is fixed
- Use parameterized queries or an ORM that does.
- Give the database account only the rights it needs.
- Treat error messages as a leak and do not show them.
Practice only on targets you have permission to test, such as a challenge instance or a local intentionally vulnerable app.
On CTF7
Web challenges with a database run as isolated lab instances per team. Organizers can add hints that unlock for a cost, and Raw Ops events score real-style reports using CVSS 4.0. Try the CVSS calculator to see how an injection bug scores.
Learn more
Read the web exploitation guide for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
