---
title: SQL injection
canonical: https://wpsecurityninja.com/dictionary/sql-injection/
---
# SQL injection

SQL injection tricks a database query into running attacker-controlled SQL, often through unsafe input handling.

Last updated: 2026-08-26

Also called: SQLi

## Related terms

- [Cross-site scripting (XSS)](https://wpsecurityninja.com/dictionary/xss/): Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- [Vulnerability](https://wpsecurityninja.com/dictionary/vulnerability/): A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- [Plugin supply chain](https://wpsecurityninja.com/dictionary/plugin-supply-chain/): Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- [CVE](https://wpsecurityninja.com/dictionary/cve/): A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.

[Full guide](https://wpsecurityninja.com/what-is-an-sql-injection-attack/)

## Why it matters for WordPress

Plugins and custom code that build SQL with raw request data can expose posts, users, or the whole database. On WordPress, that usually means a vulnerable extension, not core itself. Public CVEs get automated fast.

## How it shows up in practice

- Odd query strings that dump content or database error text
- Unexpected admin users or option changes with no human action in the log
- Scanner or advisory notes flagging a plugin CVE that mentions SQLi

## What to do

1. Keep WordPress, themes, and plugins updated.
2. Remove unused plugins and themes.
3. Prefer well-maintained extensions; check vulnerability databases when a CVE drops.
4. For custom code, use `$wpdb->prepare` and never concatenate untrusted input into SQL.
5. After a suspected SQLi incident, rotate secrets, audit users, and scan files.

Full walkthrough: [SQL injection on WordPress](https://wpsecurityninja.com/what-is-an-sql-injection-attack/).