SQL Injection to Filesystem

Definition

SQL injection occurs when input alters the structure of a query rather than only its values. What follows depends less on the injection itself than on what the database account is permitted to do.

Privilege decides the ceiling

An injection against a tightly scoped, read-only account is a data-exposure problem bounded by that account's grants. The same injection against an over-privileged account can reach file read or write primitives, extension mechanisms, or other functionality that leads toward the host rather than staying inside the schema.

This is why database privilege review belongs in the same conversation as input handling. Parameterized queries remove the flaw; least privilege bounds the consequence when something else introduces one.