SQL injection - Revision history

imported>The Hurdy Gurdy Man: /* Examples */ Copy edit.

2025-10-26T17:37:01Z

Examples: Copy edit.

imported>Annh07: Reverted edits by 82.20.76.34 (talk) to last version by OAbot

2025-06-27T11:00:18Z

Reverted edits by 82.20.76.34 (talk) to last version by OAbot

← Previous revision	Revision as of 11:00, 27 June 2025
(No difference)

imported>OAbot: Open access bot: doi updated in citation with #oabot.

2025-06-09T02:36:21Z

Open access bot: doi updated in citation with #oabot.

← Previous revision		Revision as of 02:36, 9 June 2025
Line 3:		Line 3:
	[[File:KD SQLIA Classification 2010.png\|thumb\|alt=Classification of SQL injection attack vectors in 2010\|A classification of SQL injection attacking vector as of 2010]]		[[File:KD SQLIA Classification 2010.png\|thumb\|alt=Classification of SQL injection attack vectors in 2010\|A classification of SQL injection attacking vector as of 2010]]

	In computing, '''SQL injection''' is a [[code injection]] technique used to [[Attack (computing)\|attack]] data-driven applications, in which malicious [[SQL]] statements are inserted into an entry field for execution (e.g. to dump the [[database]] contents to the attacker).<ref>{{cite web \|title=SQL Injection \|author=Microsoft \|url=https://technet.microsoft.com/en-us/library/ms161953%28v=SQL.105%29.aspx \|access-date=2013-08-04 \|quote=SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQLi Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker. \|url-status=live \|archive-url=https://web.archive.org/web/20130802094425/http://technet.microsoft.com/en-us/library/ms161953(v=sql.105).aspx \|archive-date=August 2, 2013 \|language=en}}</ref><ref name=sfw2.12018>{{Cite journal \|last1=Zhuo \|first1=Z. \|last2=Cai \|first2=T. \|last3=Zhang \|first3=X. \|last4=Lv \|first4=F. \|date=April 2021 \|title=Long short-term memory on abstract syntax tree for SQL injection detection \|journal=IET Software \|language=en \|volume=15 \|issue=2 \|pages=188–197 \|doi=10.1049/sfw2.12018 \|doi-access= \|s2cid=233582569 \|issn=1751-8806}}</ref> SQL injection must exploit a [[security vulnerability]] in an application's software, for example, when user input is either incorrectly filtered for [[string literal]] [[escape sequence\|escape characters]] embedded in SQL statements or user input is not [[Strongly-typed programming language\|strongly typed]] and unexpectedly executed. SQL injection is mostly known as an [[attack vector]] for websites but can be used to attack any type of SQL database.		In computing, '''SQL injection''' is a [[code injection]] technique used to [[Attack (computing)\|attack]] data-driven applications, in which malicious [[SQL]] statements are inserted into an entry field for execution (e.g. to dump the [[database]] contents to the attacker).<ref>{{cite web \|title=SQL Injection \|author=Microsoft \|url=https://technet.microsoft.com/en-us/library/ms161953%28v=SQL.105%29.aspx \|access-date=2013-08-04 \|quote=SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQLi Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker. \|url-status=live \|archive-url=https://web.archive.org/web/20130802094425/http://technet.microsoft.com/en-us/library/ms161953(v=sql.105).aspx \|archive-date=August 2, 2013 \|language=en}}</ref><ref name=sfw2.12018>{{Cite journal \|last1=Zhuo \|first1=Z. \|last2=Cai \|first2=T. \|last3=Zhang \|first3=X. \|last4=Lv \|first4=F. \|date=April 2021 \|title=Long short-term memory on abstract syntax tree for SQL injection detection \|journal=IET Software \|language=en \|volume=15 \|issue=2 \|pages=188–197 \|doi=10.1049/sfw2.12018 \|doi-access=free \|s2cid=233582569 \|issn=1751-8806}}</ref> SQL injection must exploit a [[security vulnerability]] in an application's software, for example, when user input is either incorrectly filtered for [[string literal]] [[escape sequence\|escape characters]] embedded in SQL statements or user input is not [[Strongly-typed programming language\|strongly typed]] and unexpectedly executed. SQL injection is mostly known as an [[attack vector]] for websites but can be used to attack any type of SQL database.

	SQL injection attacks allow attackers to [[Spoofing attack\|spoof]] identity, tamper with existing [[data]], cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. Document-oriented [[NoSQL]] databases can also be affected by this security vulnerability.{{Citation needed\|date=March 2025}}		SQL injection attacks allow attackers to [[Spoofing attack\|spoof]] identity, tamper with existing [[data]], cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. Document-oriented [[NoSQL]] databases can also be affected by this security vulnerability.{{Citation needed\|date=March 2025}}

imported>Materialscientist: Reverted edits by 88.212.130.144 (talk) (HG) (3.4.13)

2025-05-01T10:03:08Z

Reverted edits by 88.212.130.144 (talk) (HG) (3.4.13)

Show changes

← Previous revision		Revision as of 02:36, 9 June 2025
Line 3:		Line 3:
	[[File:KD SQLIA Classification 2010.png\|thumb\|alt=Classification of SQL injection attack vectors in 2010\|A classification of SQL injection attacking vector as of 2010]]		[[File:KD SQLIA Classification 2010.png\|thumb\|alt=Classification of SQL injection attack vectors in 2010\|A classification of SQL injection attacking vector as of 2010]]

	In computing, '''SQL injection''' is a [[code injection]] technique used to [[Attack (computing)\|attack]] data-driven applications, in which malicious [[SQL]] statements are inserted into an entry field for execution (e.g. to dump the [[database]] contents to the attacker).<ref>{{cite web \|title=SQL Injection \|author=Microsoft \|url=https://technet.microsoft.com/en-us/library/ms161953%28v=SQL.105%29.aspx \|access-date=2013-08-04 \|quote=SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQLi Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker. \|url-status=live \|archive-url=https://web.archive.org/web/20130802094425/http://technet.microsoft.com/en-us/library/ms161953(v=sql.105).aspx \|archive-date=August 2, 2013 \|language=en}}</ref><ref name=sfw2.12018>{{Cite journal \|last1=Zhuo \|first1=Z. \|last2=Cai \|first2=T. \|last3=Zhang \|first3=X. \|last4=Lv \|first4=F. \|date=April 2021 \|title=Long short-term memory on abstract syntax tree for SQL injection detection \|journal=IET Software \|language=en \|volume=15 \|issue=2 \|pages=188–197 \|doi=10.1049/sfw2.12018 \|doi-access= \|s2cid=233582569 \|issn=1751-8806}}</ref> SQL injection must exploit a [[security vulnerability]] in an application's software, for example, when user input is either incorrectly filtered for [[string literal]] [[escape sequence\|escape characters]] embedded in SQL statements or user input is not [[Strongly-typed programming language\|strongly typed]] and unexpectedly executed. SQL injection is mostly known as an [[attack vector]] for websites but can be used to attack any type of SQL database.		In computing, '''SQL injection''' is a [[code injection]] technique used to [[Attack (computing)\|attack]] data-driven applications, in which malicious [[SQL]] statements are inserted into an entry field for execution (e.g. to dump the [[database]] contents to the attacker).<ref>{{cite web \|title=SQL Injection \|author=Microsoft \|url=https://technet.microsoft.com/en-us/library/ms161953%28v=SQL.105%29.aspx \|access-date=2013-08-04 \|quote=SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQLi Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker. \|url-status=live \|archive-url=https://web.archive.org/web/20130802094425/http://technet.microsoft.com/en-us/library/ms161953(v=sql.105).aspx \|archive-date=August 2, 2013 \|language=en}}</ref><ref name=sfw2.12018>{{Cite journal \|last1=Zhuo \|first1=Z. \|last2=Cai \|first2=T. \|last3=Zhang \|first3=X. \|last4=Lv \|first4=F. \|date=April 2021 \|title=Long short-term memory on abstract syntax tree for SQL injection detection \|journal=IET Software \|language=en \|volume=15 \|issue=2 \|pages=188–197 \|doi=10.1049/sfw2.12018 \|doi-access=free \|s2cid=233582569 \|issn=1751-8806}}</ref> SQL injection must exploit a [[security vulnerability]] in an application's software, for example, when user input is either incorrectly filtered for [[string literal]] [[escape sequence\|escape characters]] embedded in SQL statements or user input is not [[Strongly-typed programming language\|strongly typed]] and unexpectedly executed. SQL injection is mostly known as an [[attack vector]] for websites but can be used to attack any type of SQL database.

	SQL injection attacks allow attackers to [[Spoofing attack\|spoof]] identity, tamper with existing [[data]], cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. Document-oriented [[NoSQL]] databases can also be affected by this security vulnerability.{{Citation needed\|date=March 2025}}		SQL injection attacks allow attackers to [[Spoofing attack\|spoof]] identity, tamper with existing [[data]], cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. Document-oriented [[NoSQL]] databases can also be affected by this security vulnerability.{{Citation needed\|date=March 2025}}

← Previous revision		Revision as of 17:37, 26 October 2025
Line 18:		Line 18:
	==Root cause==		==Root cause==
	{{Norefs\|section\|date=March 2025}}		{{Norefs\|section\|date=March 2025}}
	SQL Injection is a common security vulnerability that arises from letting attacker supplied data become SQL code. This happens when programmers assemble SQL queries either by string interpolation or by concatenating SQL commands with user supplied data. Therefore, injection relies on the fact that SQL statements consist of both data used by the SQL statement and commands that control how the SQL statement is executed. For example, in the SQL statement <syntaxhighlight lang="sql" inline>select * from person where name = 'susan' and age = 2</syntaxhighlight> the string '<syntaxhighlight lang="sql" inline>susan</syntaxhighlight>' is data and the fragment <syntaxhighlight lang="sql" inline>and age = 2</syntaxhighlight> is an example of a command (the value <syntaxhighlight lang="sql" inline>2</syntaxhighlight> is also data in this example).		SQL Injection is a common security vulnerability that arises from letting attacker-supplied data become SQL code. This happens when programmers assemble SQL queries either by string interpolation or by concatenating SQL commands with user supplied data. Therefore, injection relies on the fact that SQL statements consist of both data used by the SQL statement and commands that control how the SQL statement is executed. For example, in the SQL statement <syntaxhighlight lang="sql" inline>select * from person where name = 'susan' and age = 2</syntaxhighlight> the string '<syntaxhighlight lang="sql" inline>susan</syntaxhighlight>' is data and the fragment <syntaxhighlight lang="sql" inline>and age = 2</syntaxhighlight> is an example of a command (the value <syntaxhighlight lang="sql" inline>2</syntaxhighlight> is also data in this example).

	SQL injection occurs when specially crafted user input is processed by the receiving program in a way that allows the input to exit a data context and enter a command context. This allows the attacker to alter the structure of the SQL statement which is executed.		SQL injection occurs when specially crafted user input is processed by the receiving program in a way that allows the input to exit a data context and enter a command context. This allows the attacker to alter the structure of the SQL statement which is executed.
Line 132:		Line 132:
	* On January 13, 2006, [[Russia]]n computer criminals broke into a [[Government of Rhode Island\|Rhode Island government]] website and allegedly stole credit card data from individuals who have done business online with state agencies.<ref>{{cite web\|url=http://www.xiom.com/whid-2006-3\|title=WHID 2006-3: Russian hackers broke into a RI GOV website\|publisher=Web Application Security Consortium\|date=January 13, 2006\|access-date=May 16, 2008\|url-status=dead\|archive-url=https://web.archive.org/web/20110213051033/http://www.xiom.com/whid-2006-3\|archive-date=February 13, 2011 \|language=en}}</ref>		* On January 13, 2006, [[Russia]]n computer criminals broke into a [[Government of Rhode Island\|Rhode Island government]] website and allegedly stole credit card data from individuals who have done business online with state agencies.<ref>{{cite web\|url=http://www.xiom.com/whid-2006-3\|title=WHID 2006-3: Russian hackers broke into a RI GOV website\|publisher=Web Application Security Consortium\|date=January 13, 2006\|access-date=May 16, 2008\|url-status=dead\|archive-url=https://web.archive.org/web/20110213051033/http://www.xiom.com/whid-2006-3\|archive-date=February 13, 2011 \|language=en}}</ref>
	* On September 19, 2007 and January 26, 2009 the Turkish hacker group "m0sted" used SQL injection to exploit Microsoft's SQL Server to hack web servers belonging to [[McAlester Army Ammunition Plant]] and the [[United States Army Corps of Engineers\|US Army Corps of Engineers]] respectively.<ref>{{cite web\|url=http://www.informationweek.com/architecture/anti-us-hackers-infiltrate-army-servers/d/d-id/1079964\|publisher=[[Information Week]]\|title=Anti-U.S. Hackers Infiltrate Army Servers\|date=May 29, 2009\|access-date=December 17, 2016\|url-status=live\|archive-url=https://web.archive.org/web/20161220152101/http://www.informationweek.com/architecture/anti-us-hackers-infiltrate-army-servers/d/d-id/1079964\|archive-date=December 20, 2016 \|language=en}}</ref>		* On September 19, 2007 and January 26, 2009 the Turkish hacker group "m0sted" used SQL injection to exploit Microsoft's SQL Server to hack web servers belonging to [[McAlester Army Ammunition Plant]] and the [[United States Army Corps of Engineers\|US Army Corps of Engineers]] respectively.<ref>{{cite web\|url=http://www.informationweek.com/architecture/anti-us-hackers-infiltrate-army-servers/d/d-id/1079964\|publisher=[[Information Week]]\|title=Anti-U.S. Hackers Infiltrate Army Servers\|date=May 29, 2009\|access-date=December 17, 2016\|url-status=live\|archive-url=https://web.archive.org/web/20161220152101/http://www.informationweek.com/architecture/anti-us-hackers-infiltrate-army-servers/d/d-id/1079964\|archive-date=December 20, 2016 \|language=en}}</ref>
	* On April 13, 2008, the [[Sex offender registries in the United States\|Sexual and Violent Offender Registry]] of [[Oklahoma]] shut down its website for "[[routine maintenance]]" after being informed that 10,597 [[Social Security number]]s belonging to [[sex offender]]s had been downloaded via an SQL injection attack<ref>{{cite web\|url=http://thedailywtf.com/Articles/Oklahoma-Leaks-Tens-of-Thousands-of-Social-Security-Numbers,-Other-Sensitive-Data.aspx\|publisher=[[The Daily WTF]]\|title=Oklahoma Leaks Tens of Thousands of Social Security Numbers, Other Sensitive Data\|author=Alex Papadimoulis\|date=April 15, 2008\|access-date=May 16, 2008\|url-status=live\|archive-url=https://web.archive.org/web/20080510115005/http://thedailywtf.com/Articles/Oklahoma-Leaks-Tens-of-Thousands-of-Social-Security-Numbers,-Other-Sensitive-Data.aspx\|archive-date=May 10, 2008 \|language=en}}</ref>		* On April 13, 2008, the [[Sex offender registries in the United States\|Sexual and Violent Offender Registry]] of [[Oklahoma]] shut down its website for "[[routine maintenance]]" after being informed that 10,597 [[Social Security number]]s belonging to [[sex offender]]s had been downloaded via an SQL injection attack.<ref>{{cite web\|url=http://thedailywtf.com/Articles/Oklahoma-Leaks-Tens-of-Thousands-of-Social-Security-Numbers,-Other-Sensitive-Data.aspx\|publisher=[[The Daily WTF]]\|title=Oklahoma Leaks Tens of Thousands of Social Security Numbers, Other Sensitive Data\|author=Alex Papadimoulis\|date=April 15, 2008\|access-date=May 16, 2008\|url-status=live\|archive-url=https://web.archive.org/web/20080510115005/http://thedailywtf.com/Articles/Oklahoma-Leaks-Tens-of-Thousands-of-Social-Security-Numbers,-Other-Sensitive-Data.aspx\|archive-date=May 10, 2008 \|language=en}}</ref>
	* On August 17, 2009, the [[United States Department of Justice]] charged an American citizen, [[Albert Gonzalez]], and two unnamed Russians with the theft of 130 million credit card numbers using an SQL injection attack. In reportedly "the biggest case of [[identity theft]] in American history", the man stole cards from a number of corporate victims after researching their [[Payment processor\|payment processing system]]s. Among the companies hit were credit card processor [[Heartland Payment Systems]], convenience store chain [[7-Eleven]], and supermarket chain [[Hannaford Brothers]].<ref>{{cite news\|url=~~http~~://news.bbc.co.uk/2/hi/americas/8206305.stm\|title=US man 'stole 130m card numbers'\|publisher=BBC\|date=August 17, 2009\|access-date=August 17, 2009\|url-status=live\|archive-url=https://web.archive.org/web/20090818100739/http://news.bbc.co.uk/2/hi/americas/8206305.stm\|archive-date=August 18, 2009 \|language=en}}</ref>		* On August 17, 2009, the [[United States Department of Justice]] charged an American citizen, [[Albert Gonzalez]], and two unnamed Russians with the theft of 130 million credit card numbers using an SQL injection attack. In reportedly "the biggest case of [[identity theft]] in American history", the man stole cards from a number of corporate victims after researching their [[Payment processor\|payment processing system]]s. Among the companies hit were credit card processor [[Heartland Payment Systems]], convenience store chain [[7-Eleven]], and supermarket chain [[Hannaford Brothers]].<ref>{{cite news\|url=https://news.bbc.co.uk/2/hi/americas/8206305.stm\|title=US man 'stole 130m card numbers'\|publisher=BBC\|date=August 17, 2009\|access-date=August 17, 2009\|url-status=live\|archive-url=https://web.archive.org/web/20090818100739/http://news.bbc.co.uk/2/hi/americas/8206305.stm\|archive-date=August 18, 2009 \|language=en}}</ref>
	*In July 2010, a South American security researcher who goes by the [[User (computing)\|handle]] "Ch Russo" obtained sensitive user information from popular [[BitTorrent]] site [[The Pirate Bay]]. He gained access to the site's administrative control panel and exploited an SQL injection vulnerability that enabled him to collect user account information, including [[IP address]]es, [[MD5]] [[Cryptographic hash function\|password hashes]] and records of which torrents individual users have uploaded.<ref>{{cite news \|url=http://krebsonsecurity.com/2010/07/pirate-bay-hack-exposes-user-booty/\|title=The pirate bay attack\|date=July 7, 2010\|url-status=live \|archive-url=https://web.archive.org/web/20100824183455/http://krebsonsecurity.com/2010/07/pirate-bay-hack-exposes-user-booty/\|archive-date=August 24, 2010 \|language=en}}</ref>		*In July 2010, a South American security researcher who goes by the [[User (computing)\|handle]] "Ch Russo" obtained sensitive user information from popular [[BitTorrent]] site [[The Pirate Bay]]. He gained access to the site's administrative control panel and exploited an SQL injection vulnerability that enabled him to collect user account information, including [[IP address]]es, [[MD5]] [[Cryptographic hash function\|password hashes]] and records of which torrents individual users have uploaded.<ref>{{cite news \|url=http://krebsonsecurity.com/2010/07/pirate-bay-hack-exposes-user-booty/\|title=The pirate bay attack\|date=July 7, 2010\|url-status=live \|archive-url=https://web.archive.org/web/20100824183455/http://krebsonsecurity.com/2010/07/pirate-bay-hack-exposes-user-booty/\|archive-date=August 24, 2010 \|language=en}}</ref>
	*From July 24 to 26, 2010, attackers from [[Japan]] and [[China]] used an SQL injection to gain access to customers' credit card data from Neo Beat, an [[Osaka]]-based company that runs a large online supermarket site. The attack also affected seven business partners including supermarket chains Izumiya Co, Maruetsu Inc, and Ryukyu Jusco Co. The theft of data affected a reported 12,191 customers. As of August 14, 2010 it was reported that there have been more than 300 cases of credit card information being used by third parties to purchase goods and services in China.{{Citation needed\|date=March 2025}}		*From July 24 to 26, 2010, attackers from [[Japan]] and [[China]] used an SQL injection to gain access to customers' credit card data from Neo Beat, an [[Osaka]]-based company that runs a large online supermarket site. The attack also affected seven business partners including supermarket chains Izumiya Co, Maruetsu Inc, and Ryukyu Jusco Co. The theft of data affected a reported 12,191 customers. As of August 14, 2010 it was reported that there have been more than 300 cases of credit card information being used by third parties to purchase goods and services in China.{{Citation needed\|date=March 2025}}
Line 139:		Line 139:
	* On November 8, 2010 the British [[Royal Navy]] website was compromised by a Romanian hacker named [[TinKode]] using SQL injection.<ref>{{cite news\|title=Royal Navy website attacked by Romanian hacker\|date=2010-11-08\|url=https://www.bbc.co.uk/news/technology-11711478\|access-date=2023-11-15\|archive-url=https://web.archive.org/web/20101109044947/http://www.bbc.co.uk/news/technology-11711478\|archive-date=2010-11-09\|url-status=live\|publisher=BBC News\|language=en}}</ref><ref>{{cite web\|url=http://news.sky.com/skynews/Home/World-News/Stuxnet-Worm-Virus-Targeted-At-Irans-Nuclear-Plant-Is-In-Hands-Of-Bad-Guys-Sky-News-Sources-Say/Article/201011415827544\|title=Super Virus A Target For Cyber Terrorists\|author=Sam Kiley\|date=November 25, 2010\|access-date=November 25, 2010\|url-status=dead\|archive-url=https://web.archive.org/web/20101128093507/http://news.sky.com/skynews/Home/World-News/Stuxnet-Worm-Virus-Targeted-At-Irans-Nuclear-Plant-Is-In-Hands-Of-Bad-Guys-Sky-News-Sources-Say/Article/201011415827544\|archive-date=November 28, 2010\|language=en}}</ref>		* On November 8, 2010 the British [[Royal Navy]] website was compromised by a Romanian hacker named [[TinKode]] using SQL injection.<ref>{{cite news\|title=Royal Navy website attacked by Romanian hacker\|date=2010-11-08\|url=https://www.bbc.co.uk/news/technology-11711478\|access-date=2023-11-15\|archive-url=https://web.archive.org/web/20101109044947/http://www.bbc.co.uk/news/technology-11711478\|archive-date=2010-11-09\|url-status=live\|publisher=BBC News\|language=en}}</ref><ref>{{cite web\|url=http://news.sky.com/skynews/Home/World-News/Stuxnet-Worm-Virus-Targeted-At-Irans-Nuclear-Plant-Is-In-Hands-Of-Bad-Guys-Sky-News-Sources-Say/Article/201011415827544\|title=Super Virus A Target For Cyber Terrorists\|author=Sam Kiley\|date=November 25, 2010\|access-date=November 25, 2010\|url-status=dead\|archive-url=https://web.archive.org/web/20101128093507/http://news.sky.com/skynews/Home/World-News/Stuxnet-Worm-Virus-Targeted-At-Irans-Nuclear-Plant-Is-In-Hands-Of-Bad-Guys-Sky-News-Sources-Say/Article/201011415827544\|archive-date=November 28, 2010\|language=en}}</ref>
	* On April 11, 2011, [[Barracuda Networks]] was compromised using an SQL injection flaw. [[Email address]]es and usernames of employees were among the information obtained.<ref>{{cite web\|url=http://www.networkworld.com/news/2011/041211-hacker-breaks-into-barracuda-networks.html?hpg1=bn\|title=Hacker breaks into Barracuda Networks database\|url-status=dead\|archive-url=https://web.archive.org/web/20110727234547/http://www.networkworld.com/news/2011/041211-hacker-breaks-into-barracuda-networks.html?hpg1=bn\|archive-date=July 27, 2011 \|language=en}}</ref>		* On April 11, 2011, [[Barracuda Networks]] was compromised using an SQL injection flaw. [[Email address]]es and usernames of employees were among the information obtained.<ref>{{cite web\|url=http://www.networkworld.com/news/2011/041211-hacker-breaks-into-barracuda-networks.html?hpg1=bn\|title=Hacker breaks into Barracuda Networks database\|url-status=dead\|archive-url=https://web.archive.org/web/20110727234547/http://www.networkworld.com/news/2011/041211-hacker-breaks-into-barracuda-networks.html?hpg1=bn\|archive-date=July 27, 2011 \|language=en}}</ref>
	*Over a period of 4 hours on April 27, 2011, an automated SQL injection attack occurred on [[Broadband Reports]] website that was able to extract 8% of the username/password pairs: 8,000 random accounts of the 9,000 active and 90,000 old or inactive accounts.<ref name="DSLReports">{{cite web\|url=http://www.dslreports.com/forum/r25793356-\|title=site user password intrusion info\|publisher=Dslreports.com\|access-date=2011-06-03\|url-status=live\|archive-url=https://web.archive.org/web/20121018190124/http://www.dslreports.com/forum/r25793356-\|archive-date=October 18, 2012\|language=en}}</ref><ref name="Cnet News">{{cite news\|url=http://news.cnet.com/8301-27080_3-20058471-245.html\|title=DSLReports says member information stolen\|publisher=Cnet News\|date=2011-04-28\|access-date=2011-04-29\|url-status=dead\|archive-url=https://web.archive.org/web/20120321203011/http://news.cnet.com/8301-27080_3-20058471-245.html\|archive-date=March 21, 2012 \|language=en}}</ref><ref name="The Tech Herald">{{cite news\|url=http://www.thetechherald.com/article.php/201117/7127/DSLReports-com-breach-exposed-more-than-100-000-accounts\|title=DSLReports.com breach exposed more than 100,000 accounts\|publisher=The Tech Herald\|date=2011-04-29\|access-date=2011-04-29\|url-status=~~dead~~\|archive-url=https://web.archive.org/web/20110430234009/http://www.thetechherald.com/article.php/201117/7127/DSLReports-com-breach-exposed-more-than-100-000-accounts\|archive-date=April 30, 2011 \|language=en}}</ref>		*Over a period of 4 hours on April 27, 2011, an automated SQL injection attack occurred on [[Broadband Reports]] website that was able to extract 8% of the username/password pairs: 8,000 random accounts of the 9,000 active and 90,000 old or inactive accounts.<ref name="DSLReports">{{cite web\|url=http://www.dslreports.com/forum/r25793356-\|title=site user password intrusion info\|publisher=Dslreports.com\|access-date=2011-06-03\|url-status=live\|archive-url=https://web.archive.org/web/20121018190124/http://www.dslreports.com/forum/r25793356-\|archive-date=October 18, 2012\|language=en}}</ref><ref name="Cnet News">{{cite news\|url=http://news.cnet.com/8301-27080_3-20058471-245.html\|title=DSLReports says member information stolen\|publisher=Cnet News\|date=2011-04-28\|access-date=2011-04-29\|url-status=dead\|archive-url=https://web.archive.org/web/20120321203011/http://news.cnet.com/8301-27080_3-20058471-245.html\|archive-date=March 21, 2012 \|language=en}}</ref><ref name="The Tech Herald">{{cite news\|url=http://www.thetechherald.com/article.php/201117/7127/DSLReports-com-breach-exposed-more-than-100-000-accounts\|title=DSLReports.com breach exposed more than 100,000 accounts\|publisher=The Tech Herald\|date=2011-04-29\|access-date=2011-04-29\|url-status=usurped\|archive-url=https://web.archive.org/web/20110430234009/http://www.thetechherald.com/article.php/201117/7127/DSLReports-com-breach-exposed-more-than-100-000-accounts\|archive-date=April 30, 2011 \|language=en}}</ref>
	*On June 1, 2011, "[[hacktivist]]s" of the group [[LulzSec]] were accused of using SQL injection to steal [[coupon]]s, download keys, and passwords that were stored in plaintext on [[Sony]]'s website, accessing the personal information of a million users.<ref>{{citation\|title=LulzSec hacks Sony Pictures, reveals 1m passwords unguarded\|date=June 2, 2011\|work=electronista.com\|url=http://www.electronista.com/articles/11/06/02/lulz.security.hits.sony.again.in.security.message/\|url-status=dead\|archive-url=https://web.archive.org/web/20110606051745/http://www.electronista.com/articles/11/06/02/lulz.security.hits.sony.again.in.security.message\|archive-date=June 6, 2011 \|access-date=June 3, 2011\|language=en}}</ref>		*On June 1, 2011, "[[hacktivist]]s" of the group [[LulzSec]] were accused of using SQL injection to steal [[coupon]]s, download keys, and passwords that were stored in plaintext on [[Sony]]'s website, accessing the personal information of a million users.<ref>{{citation\|title=LulzSec hacks Sony Pictures, reveals 1m passwords unguarded\|date=June 2, 2011\|work=electronista.com\|url=http://www.electronista.com/articles/11/06/02/lulz.security.hits.sony.again.in.security.message/\|url-status=dead\|archive-url=https://web.archive.org/web/20110606051745/http://www.electronista.com/articles/11/06/02/lulz.security.hits.sony.again.in.security.message\|archive-date=June 6, 2011 \|access-date=June 3, 2011\|language=en}}</ref>
	* In June 2011, [[PBS]] was hacked by LulzSec, most likely through use of SQL injection; the full process used by hackers to execute SQL injections was described in this [http://blog.imperva.com/2011/05/pbs-breached-how-hackers-probably-did-it.html Imperva] blog.<ref name="PBS Breached - How Hackers Probably Did It">{{cite news\|url=http://blog.imperva.com/2011/05/pbs-breached-how-hackers-probably-did-it.html\|title=Imperva.com: PBS Hacked - How Hackers Probably Did It\|access-date=2011-07-01\|url-status=dead\|archive-url=https://web.archive.org/web/20110629080422/http://blog.imperva.com/2011/05/pbs-breached-how-hackers-probably-did-it.html\|archive-date=June 29, 2011 \|language=en}}</ref>		* In June 2011, [[PBS]] was hacked by LulzSec, most likely through use of SQL injection; the full process used by hackers to execute SQL injections was described in this [http://blog.imperva.com/2011/05/pbs-breached-how-hackers-probably-did-it.html Imperva] blog.<ref name="PBS Breached - How Hackers Probably Did It">{{cite news\|url=http://blog.imperva.com/2011/05/pbs-breached-how-hackers-probably-did-it.html\|title=Imperva.com: PBS Hacked - How Hackers Probably Did It\|access-date=2011-07-01\|url-status=dead\|archive-url=https://web.archive.org/web/20110629080422/http://blog.imperva.com/2011/05/pbs-breached-how-hackers-probably-did-it.html\|archive-date=June 29, 2011 \|language=en}}</ref>