Description
SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a web application's database server.
Remediation
Use parameterized queries when dealing with SQL queries that contain user input. Parameterized queries allow the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.
References
SQL Injection (SQLi) - Acunetix
Types of SQL Injection (SQLi) - Acunetix
Prevent SQL injection vulnerabilities in PHP applications and fix them - Acunetix
Related Vulnerabilities
WordPress Plugin Testimonial Slider SQL Injection (1.2.4)
WordPress Plugin WP Photo Album Plus 'wppa-album' Parameter SQL Injection (4.1.1)
WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery SQL Injection (1.5.54)
WordPress Plugin Tutor LMS-eLearning and online course solution SQL Injection (2.6.1)
WordPress Plugin WP-Forum 'forum_feed.php' SQL Injection (1.7.8)