---
title: SQL injection
canonical: https://wpsecurityninja.com/dictionary/sql-injection/
---
# SQL injection

SQL injection tricks a database query into running attacker-controlled SQL, often through unsafe input handling.

[Full guide](https://wpsecurityninja.com/what-is-an-sql-injection-attack/)

## Why it matters for WordPress

Plugins and custom code that build SQL with raw request data can expose posts, users, or the whole database. On WordPress, that usually means a vulnerable extension, not core itself. Public CVEs get automated fast.

## How it shows up in practice

- Odd query strings that dump content or database error text
- Unexpected admin users or option changes with no human action in the log
- Scanner or advisory notes flagging a plugin CVE that mentions SQLi

## What to do

1. Keep WordPress, themes, and plugins updated.
2. Remove unused plugins and themes.
3. Prefer well-maintained extensions; check vulnerability databases when a CVE drops.
4. For custom code, use `$wpdb->prepare` and never concatenate untrusted input into SQL.
5. After a suspected SQLi incident, rotate secrets, audit users, and scan files.

Full walkthrough: [SQL injection on WordPress](https://wpsecurityninja.com/what-is-an-sql-injection-attack/).