What is SQL Injection?

Short answer

SQL Injection is an attack that exploits user input being included in the database query of the application without being separated from it: the attacker changes the query by adding SQL fragments to the input, gains unauthorized access to the data, modifies it or deletes it (OWASP, CWE-89). In the OWASP Top 10:2021, it is in the A03 Injection category. In TR7 WAF, it is the SQL Injection category of the signature library; the signatures in this category scan the Path, Query, Header, Form, JSON, XML and Raw fields of the request, the score of the matching signature is added to the attack score of the request, and if the score reaches the OWASP Protection Level threshold, the request is blocked in Blocking mode. The same name is also a threat category in the IP Intelligence & Reputation database; on vServices with Bot/DDoS protection turned on, IP Reputation Protection puts the addresses in this category into Quarantine by default.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library → Filter	Signature Categories → SQL Injection	Listing the signatures of this attack type and managing their states (Enabled, Monitor, Disabled)
Signature & Rule Library → Columns	Signature Category, CWE (e.g. CWE-89), OWASP Web Coverage (e.g. A03:2021) columns; hidden by default	Seeing the category and classification of the rule in the table
Left Monitor Panel → WAF-Protected vServices → vService → Dashboard	Detected Attacks by Category	The distribution of the detected attacks across categories
WAF-Protected vServices → vService → Event Logs	Filter strip → Category; the Attacks tab of the record preview	Seeing which signature and category a blocked or monitored request was caught by
Configuration Menu → Settings → General Settings → IP Intelligence & Reputation	IP Categories → SQL Injection	Addresses reported for SQL Injection attempts

• The attacks WAF covers: Which attacks does TR7 WAF protect against?
• Category list: Which attack categories do the signatures cover?

Common Misconceptions

• "If there is a WAF, parameterized queries are not needed in the application." WAF is an additional layer that catches known attack patterns; the real solution is separating the input from the query (parameterized query).
• "Only the query parameter is scanned." In addition to Query, SQL Injection signatures also work in the Form, JSON, XML, Header, Path and Raw fields; the fields each signature scans are determined by Inspection Scopes.
• "A request caught by a SQL Injection signature is always blocked." Blocking depends on the total attack score of the request reaching the OWASP Protection Level threshold and on the WAF being in Blocking mode. In Monitor mode, the request is only recorded; in Learning mode, signature hits are not added to the score.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Signature & Rule Library · Score Values and the Protection Level
• WAF · The Blocking Threshold
• IP Intelligence & Reputation · IP Categories

Related questions

• Which attacks does TR7 WAF protect against?
• Which attack categories do the signatures cover?
• What are OWASP and the OWASP Top 10; where do they appear in the TR7 WAF?
• What is CWE; why does it appear in TR7 WAF logs and reports?