As the name suggests, in an SQLi attack, attackers inject malicious Structure Query Language (SQL) to get control of a SQL database and fetch sensitive user data. The attacker uses SQLi to gain access to unauthorized information, take control of an application, add new users, and so on.
Take an example of a loan-processing web application. You have loanId as a field that customers can use to get all information related to their loan finance. The typical query will look like this: SELECT * FROM loans WHERE loanId = 117. If proper care is not taken, attackers can execute a query such as SELECT * FROM loans WHERE loanId = 117 or ‘1=1' and get access to the entire customer database, as this query will always return the true result.
The other common method to hack user data through script injection is cross-site scripting (XSS) where a hacker impersonates a legitimate user. Let's learn more about it.