通過不可信來源的輸入構建動態 SQL 指令，攻擊者就能夠修改指令的含義或者執行任意 SQL 命令。
SQL injection 錯誤在以下情況下發生：
1. 數據從一個不可信賴的數據源進入程序。
2. 數據用于動態地構造一個 SQL 查詢。
例1：以下代碼動態地構造并執行了一個SQL查詢，該查詢可以搜索與指定名稱相匹配的項。該查詢僅會顯示條目所有者與被授予權限的當前用戶一致的條目。
...
String userName = ctx.getAuthenticatedUserName();
String itemName = request.getParameter("itemName");
String query = "SELECT * FROM items WHERE owner = '"
+ userName + "' AND itemname = '"
+ itemName + "'";
ResultSet rs = stmt.execute(query);
...
SELECT * FROM items
WHERE owner = <userName>
AND itemname = <itemName>;
itemName 不包含單引號字符時，才會正確執行這一查詢。如果一個用戶名為 wiley 的攻擊者在 itemName 中輸入字符串 "name' OR 'a'='a"，那么構造的查詢就會變成：
SELECT * FROM items
WHERE owner = 'wiley'
AND itemname = 'name' OR 'a'='a';
OR 'a'='a' 會使 where 從句永遠評估為 true，因此該查詢在邏輯上將等同于一個更為簡化的查詢：
SELECT * FROM items;
items 表中的條目，不論它們的所有者是誰。wiley 的攻擊者在 itemName 中輸入字符串“name'; DELETE FROM items; --”，那么最后構造的查詢將變成兩個：
SELECT * FROM items
WHERE owner = 'wiley'
AND itemname = 'name';
DELETE FROM items;
--'
name'); DELETE FROM items; SELECT * FROM items WHERE 'a'='a” 就會創建如下三個有效的 SQL 指令：
SELECT * FROM items
WHERE owner = 'wiley'
AND itemname = 'name';
DELETE FROM items;
SELECT * FROM items WHERE 'a'='a';
[1] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A1 Injection
[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A2 Injection Flaws
[3] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A6 Injection Flaws
[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[5] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[6] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 89
[7] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Insecure Interaction - CWE ID 089
[8] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Insecure Interaction - CWE ID 089
[9] Standards Mapping - SANS Top 25 2011 - (SANS Top 25 2011) Insecure Interaction - CWE ID 089
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.3.1.1, Requirement 6.5.2
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.1
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.6
[13] Standards Mapping - FIPS200 - (FISMA) SI
[14] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) SQL Injection
[15] P. Finnigan SQL Injection and Oracle, Part One Security Focus
[16] S. J. Friedl SQL Injection Attacks by Example
[17] P. Litwin Stop SQL Injection Attacks Before They Stop You MSDN Magazine
[18] M. Howard, D. LeBlanc Writing Secure Code, Second Edition Microsoft Press