In a SQL injection attack, a perpetrator inserts authorized database statements into a vulnerable SQL data channel, such as a stored procedure.