函數調用通過不可信來源的輸入構建的動態 SQL 查詢，這會允許攻擊者篡改指令的含義或執行任意 SQL 命令。
SQL injection 錯誤在以下情況下發生：
1. 數據從一個不可信賴的數據源進入程序。
在這種情況下，HP Fortify Static Code Analyzer（HP Fortify 靜態代碼分析器）不能確定數據源的可信性。
2. 數據用于動態地構造一個 SQL 查詢。
例1：以下代碼動態地構造并執行了一個SQL查詢，該查詢可以搜索與指定名稱相匹配的項。這個查詢將顯示的項限制在那些與被授予權限的當前用戶同名的所有者。
...
sprintf (sql, "SELECT * FROM items WHERE owner='%s' AND itemname='%s'", username, request.Lookup("item"));
printf("SQL to execute is:\n\t\t %s\n", sql);
rc = sqlite3_exec(db,sql, NULL,0, &err);
...
SELECT * FROM items
WHERE owner = <userName>
AND itemname = <itemName>;
itemName 不包含單引號字符時，才會正確執行這一查詢。如果一個用戶名為 wiley 的攻擊者在 itemName 中輸入字符串 "name' OR 'a'='a"，那么構造的查詢就會變成：
SELECT * FROM items
WHERE owner = 'wiley'
AND itemname = 'name' OR 'a'='a';
OR 'a'='a' 會使 where 從句永遠評估為 true，因此該查詢在邏輯上將等同于一個更為簡化的查詢：
SELECT * FROM items;
items 表中的條目，不論它們的所有者是誰。wiley 的攻擊者在 itemName 中輸入字符串 “name'); DELETE FROM items; --”，這樣，查詢將會變成以下兩個：
SELECT * FROM items
WHERE owner = 'wiley'
AND itemname = 'name';
DELETE FROM items;
--'
name'); DELETE FROM items; SELECT * FROM items WHERE 'a'='a” 就會創建如下三個有效的 SQL 指令：
SELECT * FROM items
WHERE owner = 'wiley'
AND itemname = 'name';
DELETE FROM items;
SELECT * FROM items WHERE 'a'='a';
[1] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A1 Injection
[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A2 Injection Flaws
[3] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A6 Injection Flaws
[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[5] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[6] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 89
[7] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Insecure Interaction - CWE ID 089
[8] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Insecure Interaction - CWE ID 089
[9] Standards Mapping - SANS Top 25 2011 - (SANS Top 25 2011) Insecure Interaction - CWE ID 089
[10] ODBC API Reference:SQLBindParameters() Microsoft
[11] ODBC API Reference:SQLNumParams() Microsoft
[12] OLE DB Reference:ICommandWithParameters Microsoft
[13] Parameterized CRecordset and CDatabase for SQL Server
[14] Parameterizing a Recordset Microsoft
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.3.1.1, Requirement 6.5.2
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.1
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.6
[18] Standards Mapping - FIPS200 - (FISMA) SI
[19] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) SQL Injection
[20] P. Finnigan SQL Injection and Oracle, Part One Security Focus
[21] S. J. Friedl SQL Injection Attacks by Example
[22] P. Litwin Stop SQL Injection Attacks Before They Stop You MSDN Magazine
[23] M. Howard, D. LeBlanc Writing Secure Code, Second Edition Microsoft Press