Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
User input is being directly included in SQL query strings, rather than using parameterized queries. This practice can let attackers inject malicious SQL, making your code vulnerable to SQL injection attacks.
Impact#
If exploited, an attacker could read, modify, or delete sensitive database information, potentially causing data breaches, data loss, or unauthorized access. This can lead to loss of user trust, legal consequences, and serious damage to your application’s integrity.