CQL, or Common Query Language, is a filter syntax used to express search conditions in geospatial systems. It lets users describe features by attributes, coordinates, and spatial relationships, such as “inside this bounding box” or “intersects this polygon.”
CQL matters in cyber security because it often sits in a translation layer between a web request and a database query. If an application safely parses CQL, it can turn user-friendly map filters into controlled SQL for systems like PostgreSQL and PostGIS. If that translation is weak, attacker-controlled filter text may be altered into SQL injection payloads. In practice, defenders should treat CQL input as untrusted data, enforce strict parsing, use parameterized queries where possible, and limit database privileges so a bad filter cannot become full database or host compromise.