# SQL Injection ## What is SQL Injection SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with requests made by an application to its database. These requests are commonly known as database queries and interfering them generally allow attackers to view data that is normally not accessible. Examples include data belonging to other users, or any other data that the application itself is able to access. In many cases, attackers can modify or delete this data, causing lasting changes to the application's content or behavior. In some situations, an attacker can escalate a SQLi attack to compromise the underlying server or other back-end infrastructure, or performing a denial-of-service attack. ## Impact of a successful SQL injection attack [Retrieving hidden data](#retrieving-hidden-data) - modify SQL query to retrieve additional results [Subverting application logic](#subverting-application-logic) - modify SQL query to interfere or change the application's logic [UNION attacks](/server-side/sql-injection/union-attacks.md) - retrieve data from other database tables [Examing database](/server-side/sql-injection/examing-database.md) - extract information about the version and structure of the database [Blind SQL injection](/server-side/sql-injection/blind-sql-injection.md) - where results of a query are not returned in the application's responses ## Retrieving hidden data ## Subverting application logic --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://burp.tzxiang.dev/server-side/sql-injection.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.