Editing SQL injection (section)

==History==
Discussions of SQL injection began in the late 1990s, including in a 1998 article in [[Phrack Magazine]].<ref>{{cite journal|title=NT Web Technology Vulnerabilities|author=Jeff Forristal (signing as rain.forest.puppy)|journal=[[Phrack Magazine]]|volume=8|issue=54 (article 8)|date=Dec 25, 1998|url=http://www.phrack.com/issues.html?issue=54&id=8#article|url-status=live |archive-url=https://web.archive.org/web/20140319065810/http://www.phrack.com/issues.html?issue=54&id=8#article|archive-date=March 19, 2014 |language=en}}</ref> SQL injection was ranked among the top 10 web application vulnerabilities of 2007 and 2010 by the [[OWASP|Open Web Application Security Project]] (OWASP).<ref>{{cite web |title=Category:OWASP Top Ten Project |url=https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project |url-status=live |archive-url=https://web.archive.org/web/20110519235909/https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project |archive-date=May 19, 2011 |access-date=2011-06-03 |publisher=Open Web Application Security Project (OWASP) |language=en}}</ref> In 2013, SQL injection was listed as the most critical web application vulnerability in the OWASP Top 10.<ref>{{cite web |title=Category:OWASP Top Ten Project |url=https://www.owasp.org/index.php/Top_10_2013-Top_10 |url-status=live |archive-url=https://web.archive.org/web/20131009150041/https://www.owasp.org/index.php/Top_10_2013-Top_10 |archive-date=October 9, 2013 |access-date=2013-08-13 |publisher=Open Web Application Security Project (OWASP) |language=en}}</ref>

In 2017, the ''OWASP Top 10 Application Security Risks'' grouped SQL injection under the broader category of "Injection," ranking it as the third most critical security threat. This category included various types of injection attacks, such as SQL, [[NoSQL]], OS command, and [[LDAP injection]]. These vulnerabilities arise when an application processes untrusted data as part of a command or query, potentially allowing attackers to execute unintended actions or gain unauthorized access to data.<ref>{{Cite web |title=OWASP Top 10 Application Security Risks - 2017 |url=https://owasp.org/www-project-top-ten/2017/Top_10 |access-date=9 March 2025 |website=Open Web Application Security Project (OWASP)}}</ref>

By 2021, injection remained a widespread issue, detected in 94% of analyzed applications, with reported incidence rates reaching up to 19%. That year’s ''OWASP Top 10'' further expanded the definition of injection vulnerabilities to include attacks targeting [[Object Relational Mapping]] (ORM) systems, [[Expression language|Expression Language]] (EL), and Object Graph Navigation Library (OGNL). To address these risks, OWASP recommends strategies such as using secure [[API]]s, parameterized queries, input validation, and escaping special characters to prevent malicious data from being executed as part of a query.<ref>{{Cite web |title=OWASP Top 10 2021 |url=https://owasp.org/Top10/ |access-date=9 March 2025 |website=Open Web Application Security Project (OWASP)}}</ref><ref>{{Cite web |title=A03:2021 – Injection |url=https://owasp.org/Top10/A03_2021-Injection/ |access-date=9 March 2025 |website=Open Web Application Security Project (OWASP)}}</ref>