Error-based SQL injection is a SQL injection technique that uses database error messages as a feedback channel. Instead of needing the application to return query results directly, the attacker crafts input that causes the database to fail in a predictable way. The resulting error can confirm that the payload was interpreted, and sometimes expose fragments of SQL, column names, data types, or other clues about the backend.
This matters because error messages can turn a blind guess into a guided attack. Even when a user only has read-level access, unsafe query construction can let attacker-controlled text reach the database. Repeated error responses help refine payloads, identify injectable parameters, and map the schema before moving to data theft or deeper abuse. Defenders reduce this risk by using parameterized queries, strict input validation, and error handling that hides database details from users while preserving useful logs for administrators.