SQL injection is a type of attack that targets security vulnerabilities in web applications to gain access to data sets. It is accomplished by injecting malicious SQL code into user-supplied data fields, allowing the attacker to gain access to and manipulate the underlying database. In addition to gaining access to data, SQL injection can also be used to modify existing data or even delete it. According to ISACA's Certified Information Systems Auditor (CISA) Study Guide, "SQL injection attacks are the most common type of attack against web applications and databases, and they are a major security concern."