What does SQL stand for?
SQL stands for Structured Query Language. Structured Query Language, used to query databases. SQL injection inserts attacker input into queries; parameterized queries prevent it.
SQL is the language used to define, read and change data in relational databases. A query such as SELECT name FROM customers WHERE city = 'Rome' asks the database engine for the rows that match a condition. Other statements insert, update and delete rows or create tables. The core language is common to products such as Microsoft SQL Server, PostgreSQL, MySQL and Oracle Database, each of which adds its own extensions. For security the key rule is that an application must never build a query by pasting user input into the SQL text, because the input can then change what the query does.
SQL in practice: an example
A login form builds its query by joining pieces of text, so the user name typed into the box becomes part of the SQL statement. An attacker types a quote mark followed by OR 1=1. The condition is now always true, the database returns a row and the application signs the attacker in. With a parameterized query the same input is treated as a strange user name and matches nothing.
What SQL is confused with
SQL vs NoSQL: what is the difference?
SQL databases store data in tables with fixed columns and relationships and are queried with SQL. NoSQL databases store documents, key-value pairs or graphs with a flexible structure and have their own query methods.
SQL vs SQL Server: what is the difference?
SQL is the language. SQL Server is Microsoft's database product, one of several that understand SQL. MySQL and PostgreSQL are others.
Which exams cover SQL?
SQL is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: on the acronym list, not tied to one objective.
- Network+ N10-009: 1.0 (Networking Concepts).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A web application adds whatever a user types in a search box directly to the text of its database query. Which attack does this allow?
- SQL injection
- ARP poisoning
- Bluesnarfing
- Tailgating
Show the answer
A. SQL injection. Input that becomes part of the query text can change the query. The fix is a parameterized query, which keeps the input as data.
2. Which measure prevents SQL injection at its source?
- Using parameterized queries (prepared statements)
- Moving the database to another port
- Hiding the login page from search engines
- Using longer table names
Show the answer
A. Using parameterized queries (prepared statements). With parameters, the database receives the structure of the query and the user's values separately, so a value can never run as SQL. Changing ports or names only hides the problem.
Sources: NIST glossary: SQL injection; Microsoft Learn: SQL injection; OWASP: SQL Injection; NIST glossary: Structured Query Language. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.