Common · OWASP Top 10
SQL injection
SQL injection lets an attacker change a database query through a form field or a web address. It can expose or change customer data.
Why it matters to you
Any site with search, login, filters or a booking form talks to a database. If queries are built by joining text with what a visitor typed, the visitor can change the query.
Check it yourself
- 01Search your code for queries built by joining strings with request data.
- 02Test only your own site or a copy, with permission. Never test someone else’s site.
- 03Check logs for odd characters, quotes and SQL keywords in search and login fields.
Fix it
- 01Use prepared statements with bound parameters (PDO in PHP) instead of building queries from input.
- 02Give the database account only the permissions it needs.
- 03Validate input, and hide detailed database errors from visitors.
- 04Keep the framework, CMS and plugins that build queries up to date.
How PatchRig helps
PatchRig reviews how your site builds queries, fixes the unsafe ones on a copy, and confirms the fix by testing the same entry points.