What is SQL injection?
SQL injection is an attack where someone types database commands into a form, search box or web address, and your app runs them as if they were its own. If your app builds database queries by pasting in user input, an attacker can read, change or delete your data without logging in.
Also called: SQLi
ON THIS PAGE
What it means
Your app talks to its database using a language called SQL. When someone searches, logs in or fills in a form, your app turns what they typed into a SQL question.
If the app pastes their typing straight into that question, a clever visitor can type SQL of their own. The database can't tell the difference, so it runs it.
Why it matters for vibe-coded apps
AI tools usually use safe methods, but not always. Custom search, filters and admin pages written in a hurry, or code copied from old examples, are where it slips in.
- An attacker can download your whole database.
- They can log in as anyone, including you.
- They can change prices, balances or permissions.
Example
A search box that looks up orders by email address.
// Search box text pasted straight into the query
const rows = await db.query(
"SELECT * FROM orders WHERE email = '" + search + "'"
);// The database treats the input as text, never as a command
const rows = await db.query(
"SELECT * FROM orders WHERE email = $1",
[search]
);With the safer version, typing ' OR '1'='1 just searches for an email with that odd name.
How to check if your app has this problem
- 1Search your code for queries built with + or template strings that include user input.
- 2List every place a user can type: search, login, filters and web address parameters.
- 3Try typing a single quote (') into each one. An error page is a warning sign.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Use parameterised queries (placeholders like $1 or ?) everywhere.
- 2Prefer your database library's built-in query methods over raw SQL.
- 3Give your app's database user only the permissions it needs.
Find every database query in my project that builds SQL by joining strings with user input. Rewrite each one to use parameterised queries with placeholders. Don't change what the queries return.
Check if your app has this problem
Paste your website and we'll check for SQL injection issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Cross-site scripting (XSS)Someone sneaks code into your pages that runs in other users' browsers.
- Row level securityA database setting that decides which rows each user can see or change.
- Dependency vulnerabilityA known security hole in an add-on package your app uses.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.