There is a possible SQL injection attack when the attacker adds Structured Query Language (SQL) code to a Web form input box to gain access to resources or make changes to data. An SQL query is a request for some action to be performed on a database. Typically, on a Web form developed the user needs authentication, when a their name and password are entered into the text boxes provided for them and those values entered are inserted into a SELECT query. If the values entered are found as expected, the user is allowed access; if they aren't found, access is denied. However, most Web forms have no mechanisms in place to block input other than names and passwords. Unless such precautions are taken, an attacker can use the input boxes to send their own request to the database to carry out SQL injection, which could allow them to download the entire database or interact with it illegally and thereby it is threat on data security.

Structured query language comes in different dialects, and most are based on the SQL-92 ANSI standard. An SQL query comprises one/more SQL commands, such as Update, Select and Insert. For Select queries, each query typically has a clause by which it returns data. These types of queries make SQL language so popular and flexible and more vulnerable to SQL injection attacks. As the name suggests, an SQL injection attack "injects" or manipulates SQL code.  Unexpected SQL to a query are added which makes it possible to manipulate a database not ever imagined by a database administrator.

The risk of SQL injection attacks is on the rise because of automated tools. Earlier it was dealt manually to insert SQL statements. It is believed to be a technology released with the ability to pick up a freeware tool, point it at a Web site and automatically download a database without any knowledge whatsoever. This makes things a lot more critical and severe and constant check is required to be done to protect data security and the entire database.

According to security experts, the reason that SQL injection such as cross-site scripting, are possible is that security is not taken into consideration while the development is on its way. To protect the integrity of Web sites and applications and for SQL injection protection, experts recommend simple precautions during development such as controlling the types and numbers of characters accepted by input boxes. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker. It is a challenge for the database administrators and the developers to find a way out to prevent SQL injection attacks.