SECAI Core · phase 11 of 15 · noun

Structured query language injection

An attack that injects a database query into the input data directed at a server by accessing the client side of the application.

The Explain card

Plain English
SQL injection is sneaking database commands into input fields so the server runs them as part of its own query. The attacker talks to the database through the application's front door.
Example
An LLM-powered support bot builds SQL from user questions. A customer types a request ending in "'; DROP TABLE orders; --" and the generated query deletes the table.
Why it matters
AI agents that write queries revive an old bug with a new face. Parameterized queries, least-privilege database accounts, and never treating model output as trusted code are the defenses.
Hook
The form asked for a name and got a command.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

The penetration tester used structured query language injection against a staging login form, then confirmed that parameterized statements blocked the test payload.

Why these words
  • structured Latin struere, to build or arrange modifies query language by marking it as formally organized
  • query Latin quaerere, to seek or ask identifies the request-oriented function of the language
  • language Latin lingua, tongue, through Old French langage names the system used to express database instructions
  • injection Latin inicere, to throw into serves as the head noun and places the phrase in the injection family
Where it came from
Origin
English computing terminology, expanding SQL as Structured Query Language and combining it with injection from Latin inicere
Entered the language
1990s
What changed
Query and language became specialized computing terms, while injection shifted from physical insertion to unauthorized insertion in software.
How it is spelled
Pattern
structured keeps the base structure before the suffix -ed
Pattern
language keeps the common noun ending -age
Pattern
injection uses the noun ending -tion after inject
Breaks the pattern
query changes y to i before -ed in queried but keeps y before -ing in querying

Spelled like

  • textured
  • fractured
  • passage
  • message
  • ejection
  • rejection
Broken into chunks
  • structur
    • structure
    • structural
  • query
    • queried
    • querying
  • language
    • metalanguage
    • sublanguage
  • inject
    • injector
    • injectable
What it sits beside

Same subject

Same shape

  • command injection
  • code injection
  • LDAP injection

injection vulnerabilities

  • SQL injection
  • command injection
  • LDAP injection

database query languages

  • SQL
  • XQuery
  • SPARQL

Where it sits in the deck

Phase 11: Threat Landscape: Attack Vectors and Adversarial Techniques

With defences named, learn what they must defend against — the full catalogue of attack techniques targeting AI systems, their inputs, outputs, training pipelines, and supply chains.

Neighbours in this phase