SQL Injection Risk Calculator

Likelihood = mean(query construction, validation, exposure, WAF posture, detection); impact = mean(database privilege, data sensitivity) plus a record-volume uplift, both on the OWASP 0–9 scale. Every factor uses the OWASP 0–9 ordinal scale, so a fully parameterised query scores 1 and raw concatenation scores 9. Likelihood averages the five factors that decide whether an attacker finds and lands the injection; impact averages what the compromised database account can reach, uplifted when the blast radius runs to millions of records.

SQL injection is still the fastest route from an anonymous HTTP request to your entire customer table, and the difference between Medium and Critical is usually the privilege level of one database account.

This calculator takes 8 inputs: Query construction, Input validation on the parameter, Endpoint exposure, WAF or RASP in front of the endpoint, Query anomaly logging and review, Database account privileges, Sensitivity of the reachable tables, Records reachable from this query path. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

No. A WAF lowers likelihood by a factor or two but never to 1, because signature evasion is routine and second-order injection never crosses the WAF at all. Parameterised queries remove the vulnerability class; a WAF only buys time to deploy them.