SQL injection is a flaw where untrusted input is inserted into a database query without proper validation or parameterization. Instead of asking the database for the intended data, the application may be tricked into running a modified query that reveals records, changes values, or bypasses access controls.
SQLi matters because it often affects core functions such as login, search, and admin lookups, and it can lead to data theft, tampering, or sometimes deeper compromise when paired with other bugs. In real attacks, it appears when an application builds SQL strings directly from request parameters. Defenders reduce the risk by using prepared statements, strict input handling, least-privilege database accounts, and code review focused on query construction. In products like WordPress, a SQLi in query handling can become especially dangerous if it is reachable without authentication and can be chained with other weaknesses.