WebBuilding

Languages and formats

SQL

Summary

SQL (Structured Query Language) is the standard language for creating, reading and changing data in relational databases, and it runs behind many dynamic websites, including WordPress sites. It grew out of E. F. Codd's 1970 relational model: Donald Chamberlin and Raymond Boyce of IBM published it as SEQUEL in 1974, and it was renamed SQL in 1977. ANSI made it a standard in 1986 and ISO in 1987. The current edition, ISO/IEC 9075:2023, was published in June 2023.

Web Building Encyclopedia · Languages and formats · Last reviewed October 22, 2026 · 10 min read

What SQL is

SQL, short for Structured Query Language, is the language programs use to store, find and change data in a relational database.1 A relational database keeps data in separate tables made of rows and columns, with rules for how the tables relate to one another.1

The manual for MySQL, the database behind many websites, calls SQL “the most common standardized language used to access databases.”1 In 2024, Donald Chamberlin, one of its two designers, wrote that SQL was still the most widely used database query language 50 years after it was first published.2

SQL is declarative. You describe the result you want, and the database decides how to find it. Chamberlin has written that this was a design goal from the start, leaving the planning of each query to an optimizing compiler inside the database.23

SQL commands are called statements, and they fall into a few groups:

  • Data definition. Statements such as CREATE TABLE, ALTER TABLE and DROP TABLE build, change and remove tables.4
  • Data manipulation. SELECT reads rows, INSERT adds them, UPDATE changes them and DELETE removes them. A JOIN inside a SELECT combines rows from several tables.4
  • Transactions. START TRANSACTION, COMMIT and ROLLBACK group several changes so that they all succeed or none do.4
  • Accounts and permissions. Statements such as CREATE USER, GRANT and REVOKE control who may read or change what.4

A simple example on a WordPress site would be SELECT post_title, post_date FROM wp_posts ORDER BY post_date DESC, which lists post titles from newest to oldest. The wp_posts table and its post_title and post_date columns are part of every standard WordPress installation.5

Codd’s relational model (1970)

SQL rests on an idea published by Edgar F. “Ted” Codd, an Oxford-educated mathematician at IBM’s San Jose research laboratory.6 His paper, “A Relational Model of Data for Large Shared Data Banks,” appeared in Communications of the ACM in June 1970.72

Codd proposed organizing information as related tables. A user could pull a new table out of one or more existing tables with a single query, without knowing how the data was physically laid out on disk.6 Chamberlin summed up the model’s core rule: “all information is represented by data values, never by explicit connections between records.”2

That was a break with the databases of the time. In those navigational systems, a program reached data by following links from record to record, and it could only follow paths that had been planned and built into the database design.2 Charles Bachman, a leader of that approach, had received the ACM Turing Award in 1973.2

IBM’s own history notes that in 1970 the relational model was still only a theory.6 Codd was named an IBM Fellow in 1976, and he received the ACM Turing Award in 1981.6 The award citation credits his contributions to both the theory and the practice of database management systems.8 He died in 2003 at age 79.6

From SEQUEL to SQL at IBM

Donald Chamberlin joined IBM Research in Yorktown Heights, New York, in 1971.9 He and his colleague Raymond Boyce learned about the relational model in 1972, and Chamberlin later described it as a revelation for both of them.3

Their first attempt at a query language was called SQUARE, short for Specifying Queries as Relational Expressions.10 It used a mathematical notation with subscripts that was hard to type.3

They tried again with a language written in English keywords. The result, SEQUEL (Structured English Query Language), was published as a short paper by Chamberlin and Boyce at the 1974 ACM SIGFIDET workshop in Ann Arbor, Michigan.210 Sources differ on the month: Chamberlin’s 2024 account places the meeting in June 1974, while a System R bibliography compiled by Chamberlin lists the paper in the proceedings of the ACM-SIGMOD Workshop on Data Description, Access, and Control, dated May 1974.211

The intended user was someone with no programming experience. The language was to be “framed in familiar English keywords, with no jargon or special symbols,” Chamberlin wrote.2 He has also acknowledged that SQL did not turn out to be as easy for untrained users as the designers had hoped.3

Boyce died suddenly of a brain aneurysm in 1974, about a month after presenting the SEQUEL paper. He was 26.3

System R and the first products

In 1973, IBM began System R, a project to build a working relational database at its San Jose laboratory.62 Chamberlin was one of its managers.9 The team included Patricia Selinger, who developed a cost-based optimizer for choosing how to run each query, and Raymond Lorie, who built a compiler that could save query plans for later use.6

The project ended in 1979. Its prototype was used at about 20 IBM laboratories and by three customers: Boeing, Upjohn and Pratt and Whitney.2

In 1977, because of a trademark issue, the name SEQUEL was shortened to SQL.32

The first commercial products followed:

  • Oracle. Chamberlin dates Oracle Database, the first commercial implementation of SQL, to 1979.2 IBM’s history page gives 1977 as the year Larry Ellison’s company, Relational Software (later renamed Oracle), produced the first commercially available relational database.6
  • SQL/DS. IBM released SQL/DS for its VSE and VM operating systems in 1981.28
  • DB2. DB2 first shipped in 1983 on IBM’s MVS mainframes.6 Chamberlin notes that the 1983 release was limited and general availability came the following year.2

The SQL standard

A standard is a published rulebook that different companies can build to, so that the same SQL works across many products. SQL’s standard is written by committees: in the United States, the group first known as ANSI X3H2 and now called INCITS DM32, and internationally, ISO/IEC JTC 1/SC 32.212

The American National Standards Institute (ANSI) approved the first SQL standard, X3.135-1986, on October 16, 1986.13 It was about 90 pages long.2 The US government adopted it for federal use as FIPS PUB 127 in 1987.13 The National Institute of Standards and Technology (NIST) then built a test suite of several hundred cases, and about a dozen companies had their SQL products certified against it.2

The International Organization for Standardization (ISO) published the same language as ISO 9075:1987 on June 25, 1987.14 The main editions of the standard:

EditionPublishedNotes
ANSI X3.135-1986October 16, 1986First SQL standard13
ISO 9075:1987June 25, 1987First international edition, replaced by ISO/IEC 9075:198914
ISO/IEC 9075:1992 (SQL-92)November 19, 1992Third edition; fixed early gaps such as primary keys and referential integrity153
ISO/IEC 9075:19991999Standard split into separately published parts15
ISO/IEC 9075:2023 (SQL:2023)June 1, 2023Current edition; Part 1 is in its sixth edition16

Chamberlin writes that a new version has appeared about every five years, and that Jim Melton, the standard’s editor, guided it through nine versions from 1986 to 2023.2 Over that time the standard added window functions, recursive queries, stored procedures, constraints and triggers.2 An ISO technical report published in March 2017 described SQL’s support for JSON, the data format widely used by web applications.17 In 2021 a guidance document, ISO/IEC 19075-6:2021, replaced that report.18

SQL:2023 was published in June 2023.219 It added a new Part 16, Property Graph Queries (SQL/PGQ), which defines ways for SQL to represent and query graphs of connected data.20

As of October 22, 2026, ISO lists the 2023 edition as current. On June 22, 2025, it marked the standard as one to be revised, and a committee draft of the next edition is under development.16 A technical corrigendum, a formal list of corrections, to Part 2 was published on August 3, 2026.12

Real databases follow the standard only in part. MySQL’s manual says it works toward compliance with the SQL standard without giving up speed or reliability, and that it adds its own extensions to SQL when they make the server more usable.21 SQL written for one database therefore does not always run unchanged on another.

SQL behind websites: WordPress and other CMSs

A dynamic website builds each page when a visitor asks for it, pulling the text, settings and user accounts out of a database with SQL. Chamberlin notes that MySQL, first released in 1995, soon became popular as part of the LAMP stack (Linux, Apache, MySQL and PHP) for building web applications.2

WordPress is the clearest example. As of October 2026, WordPress.org recommends MariaDB version 10.11 or greater, or MySQL version 8.0 or greater. It still works with MySQL 5.5.5 and later, though WordPress warns that such end-of-life versions may expose a site to security vulnerabilities.22 MariaDB is a fork of MySQL, a separate copy of its code that is developed on its own.2

WordPress’s documentation describes 12 core tables, each named with the default prefix wp_:235

  • Content: wp_posts, which holds posts, pages and navigation menu items, and wp_postmeta, which holds extra details about them.5
  • Comments: wp_comments and wp_commentmeta.5
  • Categories and tags: wp_terms, wp_termmeta, wp_term_taxonomy and wp_term_relationships.5
  • People: wp_users and wp_usermeta.5
  • Settings and links: wp_options, which stores the settings from the Settings screens, and wp_links.5

The column-by-column description of these tables in the older WordPress Codex was last updated for version 4.4.5 The Learn WordPress tutorial on the database, last modified in January 2024, names the same 12 tables.23 The prefix is set by $table_prefix in the wp-config.php file, which also holds the database connection details. Site owners can change the prefix from wp_, and several WordPress installations can share one database if each has a unique prefix.24

WordPress’s PHP code reaches the database through a global object called $wpdb. It names each core table for the developer, as in $wpdb->posts, and stores the site’s prefix in $wpdb->prefix.25

Other content management systems work the same way with a wider choice of databases. Drupal 11 supports MySQL 8.0 or later, MariaDB 10.6 or later, PostgreSQL 16 or later and SQLite 3.45 or later.26 Joomla 6 requires at least MySQL 8.0.13, MariaDB 10.4 or PostgreSQL 12.0.27

SQL injection and prepared statements

SQL injection is the best-known attack on SQL databases. The OWASP Foundation, a software security organization, defines it as “insertion or ‘injection’ of a SQL query via the input data from the client to the application.”28 A successful attack can read sensitive data, insert, change or delete data, and run administrative operations on the database.28

The flaw appears when a program builds a query by joining its own SQL text to whatever a visitor typed, a practice OWASP calls string concatenation.29 If a search box or login form passes a visitor’s text straight into the query, an attacker can type SQL instead of a search term, and the database runs it as part of the command.

The main defense is the prepared statement, also called a parameterized query. The program sends the database a fixed query with placeholders, then sends the visitor’s input separately, so the database always treats the input as data, never as code.29 PHP’s manual describes a prepared statement as a compiled template for the query and says the driver quotes the parameters automatically.30 OWASP lists prepared statements as its first option, and labels escaping all user-supplied input as a strongly discouraged approach.29 It also advises giving each application’s database account only the access it needs.29

WordPress’s developer documentation says all data in SQL queries must be escaped before the query runs, to prevent SQL injection.25 Its prepare() method does this with placeholders: %s for text, %d for whole numbers and %f for decimals. WordPress 6.2 added %i for table and column names.31

The problem has not gone away. In the OWASP Top 10:2025, a list of the most serious web application security risks, Injection ranks fifth.32 OWASP describes SQL injection as low in frequency but high in impact and counts more than 14,000 CVEs (published vulnerability records) for it.33 In March 2024, the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI urged software makers to eliminate the whole class of flaw by using parameterized queries with prepared statements, after an attack campaign that exploited SQL injection in a managed file transfer application.34

Timeline

  1. ISO publishes a technical corrigendum (correction) to SQL/Foundation, Part 2 of SQL:202312
  2. ISO marks SQL:2023 for revision, with a committee draft of the next edition under development16
  3. CISA and the FBI urge software makers to eliminate SQL injection with parameterized queries34
  4. ISO/IEC 9075:2023 (SQL:2023) is published, adding Part 16 for property graph queries20
  5. ISO/IEC 9075:1999 replaces SQL-92 as a standard in five separately published parts15
  6. ISO/IEC 9075:1992, known as SQL-92, is published15
  7. ISO 9075:1987 makes SQL an international standard14
  8. ANSI approves X3.135-1986, the first SQL standard13
  9. IBM ships DB2 for its MVS mainframes6
  10. IBM releases SQL/DS for its VSE and VM operating systems2
  11. Oracle Database, the first commercial SQL implementation, is released (Chamberlin's date)2
  12. SEQUEL is renamed SQL because of a trademark issue3
  13. Chamberlin and Boyce publish SEQUEL at the ACM SIGFIDET workshop in Ann Arbor, Michigan2
  14. IBM starts the System R project in San Jose6
  15. E. F. Codd publishes his relational model in Communications of the ACM7

What it means for your website

On a hosted builder such as Squarespace, Wix or Shopify, the platform runs the database and you never see SQL. On a self-hosted WordPress site, a MySQL or MariaDB database holds every post, page, comment, setting and user account.5 We build on WordPress every week, and these are the habits that protect that database.

  • Back up the database and the files. A database backup does not include your themes, plugins, uploads or wp-config.php, so both parts need saving.3536 WordPress suggests weekly backups for small sites and daily ones for busy sites, with copies kept in more than one place, and a fresh database backup before every upgrade.3635 Our website backups entry explains the options.
  • Do not edit the database by hand. A search and replace across the whole database, for example to change your domain, can cause problems with data serialization, the packed format WordPress uses for some stored values, and the handbook warns that when this changes, things break.37 WordPress’s handbook says never to change the GUID column in wp_posts and recommends WP-CLI’s search-replace command for moves.37 Plan a domain change as part of a website migration, not as a manual edit in phpMyAdmin.
  • Ask about custom code. If a developer writes custom queries for your site, ask whether every value from a form or address goes through $wpdb->prepare() or another prepared statement.3129
  • Keep database rights narrow. OWASP advises against giving an application’s database account administrator rights.29
  • Stay on supported versions. As of October 2026, WordPress recommends MariaDB 10.11 or later or MySQL 8.0 or later, and warns that older versions have reached end of life.22 Ask your web host which version your site runs on.

See also

References

  1. What is MySQL?. MySQL 8.4 Reference Manual, Oracle. accessed October 22, 2026.
  2. 50 Years of Queries. Donald Chamberlin, Communications of the ACM, vol. 67, no. 8, pp. 110-121. 2024-08. accessed October 22, 2026.
  3. Early History of SQL. Donald D. Chamberlin, IEEE Annals of the History of Computing, vol. 34, no. 4, pp. 78-82. 2012-10. accessed October 22, 2026.
  4. SQL Statements. MySQL 8.4 Reference Manual, Oracle. accessed October 22, 2026.
  5. Database Description. WordPress Codex, WordPress.org. accessed October 22, 2026.
  6. The relational database. IBM History, IBM. accessed October 22, 2026.
  7. A relational model of data for large shared data banks. E. F. Codd, Communications of the ACM, vol. 13, no. 6, pp. 377-387, Association for Computing Machinery. 1970-06. accessed October 22, 2026.
  8. Edgar F. Codd. A.M. Turing Award, Association for Computing Machinery. accessed October 22, 2026.
  9. Donald Chamberlin. Computer History Museum. accessed October 22, 2026.
  10. The 1995 SQL Reunion: People, Projects, and Politics (Prehistory). Paul McJones (editor), mcjones.org. 1997-08-20. accessed October 22, 2026.
  11. System R bibliography. Compiled by Don Chamberlin, mcjones.org. accessed October 22, 2026.
  12. ISO/IEC 9075-2:2023/Cor 1:2026, Technical Corrigendum 1. International Organization for Standardization. 2026-08-03. accessed October 22, 2026.
  13. FIPS PUB 127: Database Language SQL. National Bureau of Standards, U.S. Department of Commerce, via NIST. 1987. accessed October 22, 2026.
  14. ISO 9075:1987 Information processing systems: Database language SQL. International Organization for Standardization. 1987-06-25. accessed October 22, 2026.
  15. ISO/IEC 9075:1992 Information technology: Database languages: SQL. International Organization for Standardization. 1992-11-19. accessed October 22, 2026.
  16. ISO/IEC 9075-1:2023 Database languages SQL, Part 1: Framework (SQL/Framework). International Organization for Standardization. 2023-06. accessed October 22, 2026.
  17. ISO/IEC TR 19075-6:2017 SQL support for JavaScript Object Notation (JSON). International Organization for Standardization. 2017-03-29. accessed October 22, 2026.
  18. ISO/IEC 19075-6:2021 Guidance for the use of database language SQL, Part 6: Support for JSON. International Organization for Standardization. 2021-09-01. accessed October 22, 2026.
  19. ISO/IEC 9075-2:2023 Database languages SQL, Part 2: Foundation (SQL/Foundation). International Organization for Standardization. 2023-06. accessed October 22, 2026.
  20. ISO/IEC 9075-16:2023 Database languages SQL, Part 16: Property Graph Queries (SQL/PGQ). International Organization for Standardization. 2023-06. accessed October 22, 2026.
  21. MySQL Standards Compliance. MySQL 8.4 Reference Manual, Oracle. accessed October 22, 2026.
  22. Requirements. WordPress.org. accessed October 22, 2026.
  23. The WordPress Database. Learn WordPress, WordPress.org. 2024-01-23. accessed October 22, 2026.
  24. wp-config.php. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.
  25. wpdb. Code Reference, WordPress Developer Resources. accessed October 22, 2026.
  26. Database server requirements. Drupal.org. accessed October 22, 2026.
  27. Technical Requirements (Joomla 6.1). Joomla Programmers Documentation. accessed October 22, 2026.
  28. SQL Injection. OWASP Foundation. accessed October 22, 2026.
  29. SQL Injection Prevention Cheat Sheet. OWASP Cheat Sheet Series. accessed October 22, 2026.
  30. Prepared statements and stored procedures. PHP Manual, The PHP Group. accessed October 22, 2026.
  31. wpdb::prepare(). Code Reference, WordPress Developer Resources. accessed October 22, 2026.
  32. OWASP Top 10:2025. OWASP Foundation. accessed October 22, 2026.
  33. A05:2025 Injection. OWASP Top 10:2025, OWASP Foundation. accessed October 22, 2026.
  34. Secure by Design Alert: Eliminating SQL Injection Vulnerabilities in Software. Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation. 2024-03. accessed October 22, 2026.
  35. Backing Up Your Database. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.
  36. Backups. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.
  37. Migrating WordPress. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].