SQL injection
SQL injection is a method of exploiting a security vulnerability in a computer program by interacting with its database. The name comes from a user entering SQL code into an input field intended for ordinary data.
On this page
Source content checked . English translation published 2026-10-27.
In business automation
When automation builds a query from a form field or customer message, SQL injection is the risk that the input will become a database command. It is relevant to any integration that reads or writes records based on free text.
Examples
These examples illustrate a possible workflow. Adapt the connections and rules to your own systems.
Searching for a customer by name from a form
A workflow receives a name from a form and searches for a database record. If the name is inserted into a query as an unescaped string, an attacker can change the condition. Use parameterized queries and check that only permitted fields are returned.
Relevant tools
- Supabase
- Queries through the provided interface are preferable to building SQL from user text; row-level permissions limit damage if a failure still occurs.
What to check
- Filtering characters on the client side is not enough if the server builds SQL from free text.