SQL injection is a code-injection attack where a hacker types SQL commands into an ordinary input box, such as a login field, tricking a website's database into running commands it was never meant to run. SQL injection GCSE computer science topics (AQA and OCR) require you to explain how it works and how to stop it.
What is SQL injection?
Most websites store their data — usernames, passwords, orders, messages — in a database, and they use SQL (Structured Query Language) to fetch and update that data. When you type a username into a login box, the website usually builds an SQL query by joining your text straight onto a command string, then sends that command to the database.
SQL injection happens when a user deliberately types SQL syntax — quote marks, keywords like OR and DROP, comment symbols — into that box instead of an ordinary username. If the website has not checked or "sanitised" the input first, the database cannot tell the difference between genuine data and an attacker's command, so it runs both.
This is why exam boards classify SQL injection as a form of malicious code: the attacker is not breaking down a locked door, they are getting the system to open it for them by hiding instructions inside a normal-looking message.
How does a SQL injection attack actually work?
This section walks through a full SQL injection GCSE computer science worked example, from vulnerable code to attack input to result. Imagine a login form that builds its database query like this, joining the typed username straight onto the command:
SELECT * FROM users WHERE username = '[typed username]' AND password = '[typed password]';
Worked example. A genuine user types sarah and mypassword123, and the query becomes:
SELECT * FROM users WHERE username = 'sarah' AND password = 'mypassword123';
That runs safely and only returns Sarah's row if the password matches. Now suppose an attacker types this into the username box instead, and leaves the password box empty:
' OR '1'='1
The query the server builds is now:
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '';
Because '1'='1' is always true, the WHERE condition is satisfied for every row in the table, regardless of the password. Depending on how the query is structured, this can log the attacker in as the very first user in the database — often an administrator account — without knowing any password at all. That single quote mark is the whole attack: it closes off the intended text field early and lets the attacker's own SQL take over.
What can attackers achieve with SQL injection?
Once an injected command runs successfully, the damage is not limited to bypassing a login screen. The table below summarises the main goals GCSE specifications expect you to recognise.
| Goal | What the attacker types (in principle) | Effect on the database |
|---|---|---|
| Bypass authentication | ' OR '1'='1 in a password field |
Logs in without a valid password |
| Extract data | Injected UNION SELECT command |
Reveals rows from other tables (e.g. all customer records) |
| Delete data | Injected DROP TABLE command |
Permanently destroys a whole table |
| Modify data | Injected UPDATE command |
Changes prices, balances, or permissions |
A successful attack can therefore lead to a full data breach, financial loss, or an attacker gaining administrator control of the whole system — which is why cyber security is assessed alongside legal and ethical impacts in GCSE computer science.
How can SQL injection be prevented?
Developers defend against SQL injection with several layered techniques, and GCSE mark schemes usually want more than one named:
- Input validation — checking that submitted data matches an expected pattern (for example, rejecting a username that contains a quote mark or semicolon) before it ever reaches the database.
- Parameterised queries (also called prepared statements) — the safest fix. The query structure is fixed in advance and the user's input is always treated as pure data, never as part of the command, no matter what characters it contains.
- Least privilege accounts — the database account a website uses should only have the permissions it actually needs, so even a successful injection cannot, say, delete a table it was never allowed to touch.
- Escaping special characters — automatically converting characters like
'into a harmless form so they cannot end a command early. - Regular penetration testing — deliberately trying to break your own system to find weaknesses before a real attacker does.
Of these, parameterised queries are considered the strongest single defence, because they remove the root cause — the mixing of code and data — rather than just filtering out known-bad characters.
Where does SQL injection fit in the GCSE specification?
Both AQA and OCR place SQL injection under network and cyber security topics, alongside other threats such as malware, phishing, brute-force attacks and denial-of-service attacks. Exam questions typically ask you to:
- Define SQL injection in your own words.
- Explain, using an example, how unvalidated input lets an attacker manipulate a query.
- Identify at least one appropriate prevention method and explain why it works.
Learning one clear worked example — like the login-bypass query above — is usually enough to answer all three question types confidently, because the underlying idea (unchecked input becomes executable code) stays the same across every variation the exam board sets.
Frequently asked questions
What is a SQL injection attack in simple terms?
It is when someone types database commands into a normal input box, such as a login field, so that the website's database runs those commands instead of treating the text as ordinary data. This can let the attacker log in without a password, view private records, or damage the database.
How does SQL injection work at GCSE level — do I need real code?
You do not need to memorise complex SQL, but you should be able to explain the principle with a simple example, such as typing ' OR '1'='1 into a username field to make a login check always evaluate as true. Examiners mark you on understanding the concept — unchecked input being treated as code — rather than writing perfect syntax.
What is the difference between SQL injection and other database security attacks?
SQL injection specifically exploits how a database interprets text input, whereas other attacks such as brute-force target passwords directly by guessing them, and denial-of-service attacks aim to overload a system rather than manipulate its data. All three sit under the broader GCSE topic of network and cyber security threats, but each has a distinct method and a distinct defence.
Can SQL injection be completely prevented?
No single measure guarantees complete safety, but combining parameterised queries with input validation, least-privilege database accounts and regular testing reduces the risk to a very low level. Most successful real-world SQL injection attacks exploit systems that skipped one of these basic steps, which is exactly why GCSE mark schemes reward naming more than one defence.
Want Professor Pi or a subject specialist to walk through cyber security threats like this one, question by question? Add the AI Tutors connector at aitutors.me.