Stored SQL injection is a type of SQL injection where attacker-controlled input is written into a database or other persistent store first, then later read back and used in a query or admin workflow. The payload may look harmless at the moment it is saved, but it becomes dangerous when another part of the application trusts that stored data and builds SQL with it.
This matters because the trigger can happen long after the original upload or form submission, making the flaw harder to spot and block. In real attacks, the malicious value may be planted through comments, profile fields, import files, backup data, or synchronization features, then activated during search, restore, export, or reporting operations. Defenders reduce risk by using parameterized queries, validating and encoding data on both write and read paths, and treating restored or imported content as untrusted. Stored SQL injection can lead to data theft, tampering, or, in severe cases, broader system compromise.