Cybersecurity Glossary
SQL Injection
An attack that smuggles database commands into an ordinary web form or web address.
What SQL Injection means
When a web application inserts user input straight into a database query, an attacker can type input that changes the meaning of that query. The result can be reading the entire customer table, bypassing a login, or deleting data. It has been well understood for decades and is still found regularly, usually in old custom code or abandoned plugins.
Why SQL Injection matters for small businesses and nonprofits
Most small business sites run on WordPress or a similar platform where the risk sits in plugins and custom code rather than in the core. A single vulnerable plugin can expose every record in your database.
What to do about SQL Injection
- Remove plugins you no longer use rather than leaving them deactivated
- Keep everything updated, and replace components that are no longer maintained
- Put a web application firewall in front of the site as a second line
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.