If you have never heard of SQL or databases before, you are in exactly the right place — this step gives you everything you need before the hands-on exercise begins.
What is a database?
Almost every website you use stores information somewhere. When you create an account, your email address and password have to be saved so the site can recognize you next time. That information lives in a database.
Think of a database as a giant digital filing cabinet. The cabinet holds many tables — one drawer for each type of information. For example, this lesson uses a table called users. Inside the users drawer, every folder represents one user account — that is called a row. Each folder has labeled tabs for specific pieces of information: one tab for the email address, one for the password, one for the user's role. Those tabs are called columns.
| Analogy | Database term |
|---|---|
| Filing cabinet | Database |
| Drawer | Table |
| One folder (one user account) | Row |
| Labeled tab on a folder | Column |
What is SQL?
Websites need a way to ask questions to their database. SQL (Structured Query Language) is the language they use. It is not a full programming language — it is specifically designed for asking questions of stored data and giving commands like "add a new user" or "find me everyone with this email address."
Here is what a SQL question looks like:
SELECT * FROM users WHERE email = '[email protected]'In plain English, this means: "Look inside the users table. Find every row where the email column contains exactly '[email protected]'."
The keywords each have a specific role:
SELECT *— "give me all the columns"FROM users— "look in the users table"WHERE email = '[email protected]'— "but only return rows where the email matches this value"
When you log into a website, the server sends a question like this to its database to check whether your account exists.
What is SQL injection?
SQL injection is a security vulnerability that happens when a website builds its database question by dropping your typed input directly into the middle of the question — without separating your input from the question's own structure.
When that happens, you can type something that changes the meaning of the question itself, rather than just answering it. Your input stops being treated as data and starts being treated as part of the logic.
Why this matters
In 2009, attackers used this exact technique to steal over 130 million credit card numbers from Heartland Payment Systems — one of the largest data breaches in history at the time. SQL injection has been used to leak passwords, steal financial records, and take over entire systems.
SQL injection is ranked #3 on the OWASP Top 10 (A03:2021 — Injection). OWASP (the Open Worldwide Application Security Project) is a nonprofit that publishes the most widely-used guides and standards in web security. Despite being well understood, SQL injection still appears regularly in real applications.
What you will do in this lesson
You will attack a purpose-built practice application called SecureVault — a fictional company employee portal deliberately built with a security flaw so you can learn safely.
Your goal: type a short piece of text into a login box that tricks the database into handing over the admin account — without knowing any real email address or password. You will then capture the challenge flag (a secret code hidden in the admin account) and submit it to complete the lesson.
Everything happens in your browser. No software to install, no terminal to open.