> For the complete documentation index, see [llms.txt](https://burp.tzxiang.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://burp.tzxiang.dev/server-side/sql-injection.md).

# SQL Injection

## What is SQL Injection

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with requests made by an application to its database. These requests are commonly known as database queries and interfering them generally allow attackers to view data that is normally not accessible. Examples include data belonging to other users, or any other data that the application itself is able to access. In many cases, attackers can modify or delete this data, causing lasting changes to the application's content or behavior. In some situations, an attacker can escalate a SQLi attack to compromise the underlying server or other back-end infrastructure, or performing a denial-of-service attack.

## Impact of a successful SQL injection attack

[Retrieving hidden data](#retrieving-hidden-data) - modify SQL query to retrieve additional results

[Subverting application logic](#subverting-application-logic) - modify SQL query to interfere or change the application's logic

[UNION attacks](/server-side/sql-injection/union-attacks.md) - retrieve data from other database tables

[Examing database](/server-side/sql-injection/examing-database.md) - extract information about the version and structure of the database

[Blind SQL injection](/server-side/sql-injection/blind-sql-injection.md) - where results of a query are not returned in the application's responses

## Retrieving hidden data

## Subverting application logic