> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/Toolbase/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/Toolbase/sql-injection-vulnerability.md).

# SQL Injection Vulnerability

**SQL Injection** is a type of cyberattack where an attacker exploits vulnerabilities in an application's software by inserting or "injecting" malicious SQL code into a query that is executed by the database. This typically happens when user inputs are not properly validated or sanitized before being included in SQL statements.

The attacker can manipulate the SQL query to:

1. **Access or modify sensitive data** (e.g., passwords, personal information).
2. **Delete or alter data** in the database.
3. **Bypass authentication** and gain unauthorized access to the system.
4. **Execute administrative operations** on the database.
5. **Execute arbitrary commands** on the underlying operating system, if there are further vulnerabilities.

Tools can be used to perform SQL injection vulnerability are as follows : 

```
1. SQLMAP :  Automated sql vulnerability checker
2. OWASPZAP :  OpenSource web application security checker
3. DSSS : Python based sql vulnerability checker
4. Gauri :  SQL Injection tool
```