SQL injection attacks still enable breaches, all these years later

An indictment unsealed in Newark, N.J. last week listed SQL injection as the network infiltration method for 12 of 17 corporations that were fleeced of roughly 160 million credit card numbers in a seven-year-long hacking campaign that ended last year.

The attack method has been on the radar of security pros for more than 15 years, yet organizations still are struggling mightily with shoring up their code defenses.

But what is SQL injection and why is it still such a powerful attack method for hackers?  SQL stands for structured query language and is a programming language designed for managing data. SQL injection typically involves an attacker inputting SQL statements into an entry field that will force the system to execute potentially malicious commands, such as, for example, allowing illicit access to a credit card database.