Skip to content

SQL Injection

What is SQL Injection?

A web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. SQL injection can be used to view, modify, or delete data and in some cases gain complete control of the database server.

Information Security

Frameworks that govern sql injection

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on sql injection

Requirements naming sql injection across 6 standards, quoted from the control text.

CWE Top 25 Most Dangerous Software Weaknesses (2024)1 control

Rank 3 in the 2024 CWE Top 25 (frequency x severity of CVEs). SQL Injection: user input is incorporated into an SQL query without proper neutralisation, allowing modification of query logic and unauthorised data access.

CWE-89 · Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) →
ITU-T X.805 - Security Architecture for End-to-End Communications1 control

X.805 Clause 8 defines 5 Threat Categories that the X.805 Security Architecture is designed to mitigate + provides a Threat-Dimension Countermeasure Matrix linking each threat to specific Dimensions.

X805-Threats-Destruction-Corruption-Removal-Disclosure-Interruption-72Cell-Matrix-Application · ITU-T X.805 5 Threat Categories - Destruction + Corruption + Removal + Disclosure + Interruption + Threat-Dimension Countermeasure Matrix + 72-Cell Matrix Application + STRIDE + MITRE ATT and CK + Network Modular Risk Assessment →
OWASP API Security Top 10 - 20231 control

Address API7:2023 Server Side Request Forgery (SSRF) + input validation per OWASP API Security Top 10 2023 + OWASP-API-PRG-05 Input and Output Validation.

OWASPAPI-5 · Server Side Request Forgery (SSRF) and Input Validation →
OWASP Top 10 for LLM Applications 20251 control

Address OWASP LLM05:2025 Improper Output Handling + LLM09:2025 Misinformation. Improper Output Handling occurs when LLM output is consumed by downstream systems (browsers + databases + code execution + tools) without validation + sanitisation enabling XSS + SQ...

OWASPLLM-2 · Improper Output Handling and Misinformation (LLM05 + LLM09) →
OWASP Top 10:20251 control

Address OWASP Top 10 A03 Injection per OWASP Top 10:2025. Injection occurs when untrusted data is sent to an interpreter as part of a command or query enabling SQL injection + NoSQL injection + LDAP injection + OS command injection + ORM injection + XML/XPath...

OWASPTOP10-3 · A03:2025 Injection Including Cross-Site Scripting →
Secure by Design: A Guide for Manufacturers (CISA)1 control

Use parameterized queries or prepared statements for all database interactions. Eliminate SQL injection as a class of vulnerability.

SBD-DEV-02 · Parameterized Queries →

Questions people ask about sql injection

What is SQL Injection?
A web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. SQL injection can be used to view, modify, or delete data and in some cases gain complete control of the database server.
Why is SQL Injection important for compliance?
SQL Injection is a key concept in Information Security. Understanding sql injection helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address SQL Injection?
SQL Injection appears in the requirement text of CWE Top 25 Most Dangerous Software Weaknesses (2024), ITU-T X.805 - Security Architecture for End-to-End Communications, OWASP API Security Top 10 - 2023, OWASP Top 10 for LLM Applications 2025, OWASP Top 10:2025. Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about SQL Injection?
Explore our compliance framework pages to see how sql injection applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how SQL Injection applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.