SQL injection in Cybersecurity - Step-by-Step Execution

Concept Flow - SQL injection

User inputs data

↓

Input sent to SQL query

↓

SQL query constructed

↓

Database executes query

↓

If input contains malicious SQL code?

Yes→Malicious SQL runs

↓

Data leaked or altered

↓

Query runs normally

↓

Security breach

↓

Expected data returned

↓

User sees results

User input is added to a SQL query. If input contains harmful SQL code, the database runs it, causing data leaks or changes.

Execution Sample

Cybersecurity

user_input = "' OR '1'='1" 
query = "SELECT * FROM users WHERE name = '" + user_input + "'"
execute(query)

Shows how a malicious input changes a SQL query to always return data.

Analysis Table

Step	User Input	SQL Query Constructed	Database Action	Result
1	' OR '1'='1	SELECT * FROM users WHERE name = '' OR '1'='1'	Execute query	Returns all users because condition is always true
2	Alice	SELECT * FROM users WHERE name = 'Alice'	Execute query	Returns data for user Alice
3	'; DROP TABLE users; --	SELECT * FROM users WHERE name = ''; DROP TABLE users; --	Execute query	Deletes users table (dangerous)
4	Bob	SELECT * FROM users WHERE name = 'Bob'	Execute query	Returns data for user Bob
5		SELECT * FROM users WHERE name = ''	Execute query	Returns no users
6	END			Stop execution

💡 Execution stops after processing all inputs or when malicious code causes failure.

State Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	Final
user_input	None	' OR '1'='1	Alice	'; DROP TABLE users; --	Bob		END
query	None	SELECT * FROM users WHERE name = '' OR '1'='1'	SELECT * FROM users WHERE name = 'Alice'	SELECT * FROM users WHERE name = ''; DROP TABLE users; --	SELECT * FROM users WHERE name = 'Bob'	SELECT * FROM users WHERE name = ''	None

Key Insights - 3 Insights

Why does the query return all users when input is "' OR '1'='1"?

Because the input changes the WHERE clause to always be true ('1'='1'), so the database returns all rows (see execution_table step 1).

How can malicious input delete data?

If input includes SQL commands like "; DROP TABLE users; --", the database runs those commands, deleting tables (see execution_table step 3).

Why does an empty input return no users?

Because the query looks for name = '', which matches no users, so no data is returned (see execution_table step 5).

Visual Quiz - 3 Questions

Look at the execution_table at step 1. What does the query return?

A Only user '1'

B No users

C All users

D An error

💡 Hint

Check the 'Result' column in execution_table row 1.

At which step does the database get a command to delete data?

A Step 3

B Step 2

C Step 4

D Step 5

💡 Hint

Look for DROP TABLE command in 'SQL Query Constructed' column.

If user_input was always safe text like 'Charlie', how would the query behave?

A Return no users

B Return data only for Charlie

C Return all users

D Delete tables

💡 Hint

See variable_tracker for safe inputs and their queries.

Concept Snapshot

SQL injection happens when user input is added directly to SQL queries.
Malicious input can change query meaning, causing data leaks or damage.
Always validate or use safe methods to handle user input.
Example: input "' OR '1'='1" makes query return all data.
Prevent by using prepared statements or parameterized queries.

Full Transcript

SQL injection is a security problem where bad input changes a database query. When a user types something, it is added to a SQL command. If the input includes special SQL code, the database runs it. This can cause data leaks or delete data. For example, input like "' OR '1'='1" makes the query always true, returning all data. Another input can delete tables. Safe coding means never adding user input directly to queries. Use prepared statements to keep data safe.