SQL injection
An attack that types malicious commands into a form to read or damage a site's database.
What is SQL injection?
SQL is the language used to query many databases. In a SQL injection, the attacker types a piece of that language, disguised as ordinary data, into a form field or a page's address, hoping the system will run it as a command and hand over information or delete something.
The main defense is building queries so that whatever the user types is always treated as data, never as a command. On top of that, we add filters that block the attempt before it ever reaches the site.
Why it matters to your business
It's one of the best-known attacks against sites with a database, and a single poorly built form can expose your customers' data. Beyond the direct damage, a leak of personal data can bring legal trouble under data protection law.
How we use this at Damorus
Protection against SQL injection is part of the baseline security in every one of our plans, alongside Cloudflare. At URG Technology, the store never builds SQL queries out of text the customer types: it talks to the database through Supabase and server-side functions, and Row Level Security rules limit what each session is allowed to read or write.
Need this on your project?
I want my free mockup →