SQL injection, or SQLi, is an attack on an SQL database where a code or database query is inserted via some form of input from a client to the application. SQLi is one of the oldest vulnerabilities, but still one of the most common and, since SQL-based databases are so common, one of the most dangerous.

The severity of SQL injection attacks is limited by the attacker's skill and imagination, and to a lesser extent, defense in depth countermeasures, such as low-privilege connections to the database server. In general, consider SQL injection a high-impact severity.

Before we can inject SQL, we should have a basic understanding of SQL and also understand database structures.

SQL is considered a fourth-generation programming language because it uses standard human-understandable words for its syntax: just English and brackets. SQL is used for databases and we can use it to create tables; add records, delete, and update, set permissions to users; and so on.

Here's a basic query to create a table:

create table employee 
(first varchar(15),
last varchar(20),
age number(3),
address varchar(30),
city varchar(20),
state varchar(20));

The preceding code says create a table named employee with the following columns, first, last, age, address, and city, then state and assign their data types with varchar(15) character limits [Variable Character, with a max of 15 characters], and number(3) [Numbers only, max 3 numbers therefore 999].

Here is a basic query (also known as a select statement) to retrieve data from a table:

select first, last, city from employee

The select statement is the query we'll be exploiting.

When you log in to a website, it sends a select query/statement to the database to retrieve the data to confirm the data you logged in with.

Let's say the login page looks like this:

The query on the backend when logging in may look like this:

SELECT * from users WHERE username=’username’ and password=’password’

The preceding statement says select all (*) from the table named users where the column username=  is the variable username (Login field) and the column password = is the variable password (Password field).