SQL

SQL is how software and people talk to a database. A query describes what you want, such as "every order from last month over a certain amount", and the database works out how to fetch it. It is used by MySQL, MariaDB, PostgreSQL, SQL Server, SQLite and many others, each with small differences in dialect.

SQL is not a database itself, and it is not a general programming language for building websites. It is a language for one job, managing data. Many marketers and analysts learn enough SQL to pull their own reports, which is often the most direct way to answer a question the dashboards do not cover. Tools such as Google Analytics 4 can also export raw data to warehouses that are queried with SQL.

How it works

Four statements do most of the work. SELECT reads data, INSERT adds new rows, UPDATE changes existing ones and DELETE removes them. A SELECT query names the table, the columns wanted and the conditions, and can join tables together, for example combining orders with customers to list each order alongside the customer's town.

SQL is declarative: you describe the result, not the steps. The database's query planner chooses how to get it, using indexes where they exist. The same question can take a fraction of a second or several minutes depending on whether a suitable index is there, which is why slow pages are sometimes fixed by adding an index rather than by changing any code.

When website code builds SQL queries from what visitors type, it must keep that input separate from the query itself, usually with prepared statements. If it does not, a visitor can type SQL into a form field and have the database run it. This attack, called SQL injection, has been used to read, alter and delete entire customer databases.

Example

A travel agency wants to know which tours were booked most by repeat customers last year. The booking dashboard has no such report. A developer writes a single query that joins bookings to customers, keeps only customers with more than one booking, groups the results by tour and sorts them by count.

The owner gets the answer in a few minutes, and the query is saved so it can be run again next year. Because it only reads data, it is run with a read-only database user, so a typo could never change or delete a booking. The same report bought as a separate analytics add-on would have cost a monthly fee for a question the agency asks once a year, and the query also shows the developer that two customers were stored twice under slightly different email addresses, which is cleaned up afterwards.

Why it matters for your business

You do not need to write SQL to run a website, but it shapes two things you care about. First, security: SQL injection remains one of the most damaging and well-known web vulnerabilities, and the defence is careful code and keeping plugins and platforms updated. Second, insight: much of what you might want to know about customers and sales is already in your database, and a short query can often answer it more cheaply than a new reporting tool. Always run such queries on a copy or with read-only access.

Common mistakes

• Building queries by pasting visitor input straight into SQL, which opens the door to injection attacks.
• Running an UPDATE or DELETE without a condition and changing every row in the table instead of one.
• Experimenting with queries on the live database instead of a copy or a read-only account.
• Adding features that run dozens of queries per page when one well-written query would do.

Questions people ask

Is SQL hard to learn?

The basics are approachable. Many people learn to write useful SELECT queries, with filters, sorting and simple joins, in a few days of practice. Designing databases, tuning performance and writing complex reports take much longer, but reading and reporting are within reach for most analysts and marketers.

What is SQL injection?

SQL injection is an attack where someone types database commands into a form or web address, and badly written code passes them to the database to run. It can expose or destroy data. Prepared statements and keeping software updated are the standard defences.

Is MySQL the same as SQL?

No. SQL is the language; MySQL is one database system that understands it. PostgreSQL, MariaDB, SQL Server and SQLite are others. They share the core of SQL but each adds its own features and small differences, so queries are not always copyable between them.