Microsoft SQL Server is one of the world's most popular database platforms. According to some estimates as many as one in three databases runs on SQL Server, alongside competitors such as Oracle, MySQL, and PostgreSQL.

However, SQL Server is not a single product. Since its original launch in 1989, there have been more than 20 major releases of SQL Server. At the time of writing four different releases are still supported, namely: 

SQL Server 2016;

SQL Server 2017;

SQL Server 2019; and 

SQL Server 2022. 

All supported releases of SQL Server can handle everyday database tasks, but there are several reasons why it's important to know which specific version you're using.

How to check your SQL Server version

Support lifecycle

If you're planning a deployment, or scoping out future database projects, you need to know that your SQL Server installation will be supported for the required duration, or you might miss out on important security or functionality updates.

Each version of SQL Server receives around five to six years of mainstream support after its release, meaning it may receive new features and performance improvements alongside security updates. After this, there's a five-year period of extended support when no new features are added, but security updates and paid technical support are still available. Once extended support ends, no more assistance or updates will be provided, even if critical security vulnerabilities are discovered.

Here are the key support dates for the current major editions of SQL Server:

As you can see, the 2016 and 2017 editions of SQL Server are already out of mainstream support and will be entirely unsupported within three years. For this reason, it's important to keep track of the SQL Server version, whether you're beginning a new project or maintaining an existing database. 

Feature availability

Each subsequent release of SQL Server brings new capabilities that weren't available in previous editions. For example, SQL Server 2016 introduced enhanced encryption capabilities, for working with sensitive information such as financial data; it also brought JSON support, making it easier to programmatically extract and process data. 

New features in SQL Server 2017 included new string manipulation functions and automatic performance tuning, while SQL Server 2019 brought support for big data clusters and improvements for parallel processing. The latest SQL Server 2022 release has many features designed to work better with Azure and other cloud data sources.

If you're building a new database application, you'll want to know which version of SQL Server you're using, to ensure you have access to all the capabilities you might need.

Security and feature updates

As well as knowing which major SQL Server edition you're using, it's important to check the minor version number (the digits after the first decimal point) to ensure that the latest available updates to security and functionality have been installed. 

An up-to-date installation might have two different version numbers, depending on how server updates have been configured. If the server is set to receive GDR (General Distribution Release) updates then only security fixes will be added to the original installation, and the version number will reflect that. If it's on the CU (Cumulative Update) branch it will also receive new features and usability enhancements, and will usually have a higher version number.

You can check the latest GDR and CU version numbers on Microsoft's SQL Server update page. At the time of writing the latest updates for the past three releases are:

SQL Server 2016 and earlier major releases were updated with milestone Service Packs as well as individual GDR and CU updates; see the Microsoft website for details of the latest version numbers for different Service Pack levels.

SQL Server version number

The moment you've been waiting for: how to check your SQL Server version number.

There are numerous methods you can use to check the major and minor version numbers of a SQL Server instance. Here are four quick ways to find the information:

1. Use SQL Server Management Studio

Microsoft's free SQL Server Management Studio tool can provide extensive information about a SQL Server installation. After you've connected the application to your SQL Server instance, check the Object Explorer window and you should see the server's version number shown in brackets after its name. If you can't see the full version number, or want more information, right-click on the server name and select Properties to open a window with many more details about the version and capabilities of the server.

2. Query the server directly

You can query a SQL Server's version number directly from a Windows command prompt. To connect to the server, enter sqlcmd -S servername\instancename, replacing server\instancename with the appropriate details for your server. If your connection is successful, you should now see a "1>" prompt: enter "select @@version", then at the "2>" prompt, enter "go". This should return a copyright statement which includes the server version number and build date.

3. Examine the executable

If you have desktop access to the computer your SQL Server instance is running on, you can check the version number by inspecting the executable file that runs the server. By default you'll find this file in a folder called C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn (the precise path will be slightly different for older versions of SQL Server); navigate here in the Windows File Explorer, then find the file called sqlservr.exe, right-click on it and select "Properties". In the Properties window that opens, click on the Details tab to see information about the server, including its version number.

4. Check the log files

You can also find your SQL Server version number by inspecting its logs. By default, these are stored in a folder called C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Log (again, this will be slightly different for older versions of SQL Server). Note that this folder is protected, so you'll need to either edit its security settings to give yourself access or navigate to it from an elevated Command Prompt.

Once you've got access to the Log folder, open the text file called ERRORLOG, or any older file with this name and a numbered extension. The first line of each log file contains the version number of the server.

Provided by

Organisations need the ability to back up their legacy data, and with the choice of open source and commercial databases available, you can choose the best option for your business.

Join Database & Solutions Specialists’, Domagoj Kovac and Baris Furtinalar, as they discuss options for running managed services for your SQL servers, which offer full control, automated backups and options for scale.

Download this webinar for expert guidance on best performance and migration in order to make your tech life easier.

Extracting actionable intelligence from the ever-increasing volumes of data enterprises generate is fundamental to maintaining a competitive edge. Structured Query Language (SQL) serves as a critical tool for this data interaction, enabling professionals to manage, retrieve, and analyze information efficiently. As organizations increasingly rely on data-driven decision-making, the ability to effectively harness database technologies is paramount. For individuals and teams looking to develop or sharpen these vital capabilities, a diverse range of SQL courses provides structured learning paths, offering a clear route to mastering this essential programming language.

Up-skilling through dedicated training remains a highly effective strategy for building crucial technical competencies within IT teams, and SQL proficiency is consistently among the most sought-after skills. Investing in SQL education can lead to significant improvements in operational efficiency, allowing businesses to unlock deeper insights from their data repositories. For IT professionals, acquiring or enhancing SQL skills not only broadens their technical toolkit but also opens doors to new career opportunities and increased marketability in a competitive landscape.

In this article, we look at some of the most effective SQL courses available, designed to empower you with this essential programming language and enhance your data-handling proficiency. The enduring relevance of SQL, even with the advent of newer data technologies, means that expertise in this area is a valuable asset. Whether you're starting your journey with databases or aiming to refine advanced querying techniques, the right course can provide the knowledge and practical experience needed to succeed.

What is SQL?

SQL, often pronounced 'sequel', has been a cornerstone of data management since its emergence in the late 1970s. It is a standardized programming language specifically designed for managing and manipulating relational databases—systems that store information in tables with predefined relationships between them. 

The primary function of SQL is to allow users to query these databases, meaning they can request specific data, update existing records, insert new information, and manage the database structure itself.

The skills required to write effective SQL queries have remained in high demand since the language's inception. Even with the rise of NoSQL databases and big data technologies, SQL continues to be a dominant force in data interaction. Most businesses rely on SQL-backed systems for critical operations, leading to a persistent and strong demand for personnel with robust SQL programming skills.

Whether you aim to broaden your existing technical skill set or are embarking on a new career in data analysis, database administration, or software development, achieving proficiency in SQL can significantly expand your professional opportunities.

How We Chose The Best SQL Courses - new sectionSelecting the most effective SQL courses requires careful consideration of various factors critical to a positive and impactful learning experience. For this IT Pro guide, we evaluated a wide array of SQL training options based on several key criteria. These include the comprehensiveness and depth of the curriculum, the expertise of the instructors and the reputation of the providing institutions or platforms, and a strong emphasis on practical, hands-on learning through real-world examples and exercises.We prioritized courses with recently updated content that reflects current SQL standards, database technologies, and industry best practices. Significant weight was also given to consistently high student ratings and positive reviews, indicating a proven track record of delivering value. Furthermore, this selection aims to cater to diverse needs within the IT professional community, offering pathways for beginners, specialized options for roles in data science or marketing, and advanced courses for experienced users looking to optimize performance or master specific database ecosystems like Microsoft Azure or Google Cloud. Our goal is to highlight courses that not only teach SQL but also empower learners to apply these skills effectively in their professional roles.

The best SQL courses for 2026

The Ultimate MySQL Bootcamp: Go from SQL Beginner to Expert

Best overall SQL course

Provider: Colt Steele (via Udemy)

Price: TBC - available via a Udemy plan (pricing starts at £15 per month)

Course link: The Ultimate MySQL Bootcamp: Go from SQL Beginner to Expert

Course duration: 21 hours

This highly-rated Udemy course, led by reputable instructor Colt Steele was last updated in April 2025. It's designed to transition students from SQL novices to proficient users capable of tackling complex database tasks. The curriculum is comprehensive, covering fundamental SQL syntax, database creation and management, advanced querying techniques including joins and Window Functions with MySQL 8, and practical data modeling for real-world scenarios.

Emphasizing a hands-on approach, the bootcamp is packed with exercises, challenges, and projects to solidify learning. Upon successful completion, students are expected to confidently interact with any SQL database, particularly MySQL, generate insightful reports, and leverage SQL for data-driven decision-making or application integration.

Databases and SQL for Data Science with Python

Best SQL course with academic credit

Provider: IBM (via Coursera)

Price: Typically included with a Coursera Plus subscription (e.g., around $59/month or an annual option) or available through Coursera's single course purchase/specialization pricing, which can vary.

Course link: Databases and SQL for Data Science with Python

Course length: 33-35 hours

This course, offered by IBM through Coursera, is designed for individuals looking to build a foundational understanding of SQL and its application in data science, particularly when working with Python. It offers a structured learning path for beginners with no prior database programming experience. 

Across its modules, learners will explore relational database concepts, learn to create and access databases, execute SQL queries for data retrieval and manipulation, and understand how to use Python to interact with databases. A key feature is its integration within broader IBM professional certificates, and successful completion can contribute to those credentials. The curriculum covers essential SQL commands, data types, and delves into more advanced topics relevant to data engineering.

SQL: Master SQL Database Queries in Just 90 Mins!

Best SQL course for intensive learning

Provider: Udemy

Price: $44 (£34.99)

Course link: SQL - Master SQL Database Queries in Just 90 Minutes!

Course length: 1 hour 30 minutes

This Udemy course is designed for individuals seeking a rapid introduction to SQL database queries, promising to cover the essentials in approximately 90 minutes. Given the widespread use of SQL databases across businesses, a fundamental understanding of basic querying is a valuable skill for many professionals. It offers a focused curriculum designed for rapid skill acquisition. 

This offering serves as a crash course, guiding students from foundational concepts to writing their initial queries. It's positioned as an ideal starting point for those who have regular interaction with SQL databases and need a quick primer to become functional.

SQL & Database Design A-Z: Learn MS SQL Server + PostgreSQL

Best SQL course for data science

Provider: Kirill Eremenko, et al (via Udemy)

Price: £59.99 ($75)

Course link: SQL & Database Design A-Z: Learn MS SQL Server + PostgreSQL

Course length: 12 hours 30 minutes

This Udemy course, developed by Kirill Eremenko and the Ligency Team, is presented as a comprehensive guide for individuals aiming for careers in data science, data analytics, or database administration. Students will learn to craft database queries for both PostgreSQL and Microsoft SQL Server. The curriculum also delves into the distinctions and applications of OLAP (Online Analytical Processing) and OLTP (Online Transaction Processing) databases and includes numerous practical exercises to solidify understanding of both MS SQL Server and PostgreSQL.

The course focuses heavily on database design principles, an essential skill for anyone looking to build robust and efficient database solutions. It aims to provide a strong foundation in SQL, database architecture, and practical application across two major database systems.

Advanced SQL for Query Tuning and Performance Optimization

Best SQL course for advanced users

Provider: LinkedIn Learning

Price: : Included with a LinkedIn Learning subscription (typically around $29.99/month if billed annually, or $39.99/month if billed monthly. Individual course purchase options may also exist, often around $35-45).

Course link: Advanced SQL for Query Tuning and Performance Optimization

Course length: 1 hour 44 minutes

Learning to create SQL queries in isolation is insufficient for real-world application; understanding query execution and its impact on database performance is crucial. This LinkedIn Learning course, with expert instruction from Dan Sullivan, delves into the practicalities of SQL query execution. 

It focuses on how queries affect database resources and processing power. The content guides learners through modeling strategies to ensure each query runs efficiently and avoids negative impacts on overall database performance, covering essential techniques for query tuning and optimization.

Excel to MySQL: Analytic Techniques for Business Specialization

Best SQL course for Excel users

Provider: Duke University (via Coursera)

Price: Typically included with a Coursera Plus subscription (e.g., around $59/month or an annual option). Specific pricing for the specialization, if purchased standalone, can vary but is often in the range of $49−79 per month after a trial period.

Course link: Excel to MySQL: Analytic Techniques for Business Specialization

Course length: Approximately 7 months, assuming a pace of around 3 hours per week

This Coursera specialization, offered by Duke University, is designed to empower learners to bridge the gap between spreadsheet analysis and more powerful database querying techniques. It guides students through a structured path, starting with data analysis in Excel and progressively introducing MySQL for more complex data manipulation and business intelligence tasks. 

The curriculum focuses on practical analytic techniques, enabling participants to manage large datasets, extract meaningful insights, and make data-driven business decisions. This comprehensive program is suitable for those looking to enhance their analytical capabilities by moving beyond the limitations of Excel for larger-scale data work.

Learn SQL

Best SQL course for comprehensive learning

Provider: Udacity

Price:  £377.50 for a one-time payment. A monthly subscription is £94 per month.

Course link: Learn SQL

Course length: 2 months (estimated)

Udacity's "Learn SQL" course is designed to equip students with the ability to write SQL queries for analyzing substantial datasets. The curriculum typically starts with fundamental SQL commands, functions, and data cleaning methodologies. Learners then progress to understand how these querying skills are applied to both relational databases (like PostgreSQL) and an introduction to non-relational database concepts. 

A key feature of Udacity's approach is the inclusion of real-world projects designed to build practical skills. Students often benefit from mentor support and career services, depending on the specific program enrollment. This course aims to provide a comprehensive learning experience for those starting or advancing their SQL capabilities.

MS SQL Server: Learn MS SQL Server from Scratch

Best SQL course for MS SQL users

Provider: Udemy

Price:  £59.99

Course link: MS SQL Server: Learn MS SQL Server from Scratch

Course length: 5 hours 30 minutes

This Udemy course, offered by Oak Academy, focuses on teaching the fundamental aspects of creating and managing databases using Microsoft SQL Server. Students will be introduced to writing MS SQL queries and will also learn to use SQL Server Management Studio (SSMS), a graphical interface for managing and extracting information from SQL Server databases. 

The course focuses on practical application, guiding learners from initial database creation to effective data management within an MS SQL Server environment, making it ideal for those new to this specific RDBMS.

Learn Intermediate SQL for Marketers and Product Managers

Best SQL course for marketing

Provider: Codecademy

Price: £120 ($149.99)

Course link: Learn Intermediate SQL for Marketers and Product Managers

Course length: 5 hours (approximately)

This Codecademy Pro course is specifically tailored for marketing and product professionals who need to leverage SQL for data-driven insights. Recognizing that sales funnels, churn metrics, and customer data are often stored in databases, this course empowers those without prior programming knowledge to query this information effectively. 

The curriculum focuses on practical, intermediate SQL skills directly applicable to marketing analytics and product management, such as analyzing user behavior, segmenting customers, and measuring campaign performance. Its hands-on, interactive learning environment is designed to make SQL accessible and immediately useful for optimizing strategies and understanding business performance.

Deploying Microsoft Azure Synapse Analytics and Azure SQL Database

Best SQL course for MS Azure users

Provider: Pluralsight

Price: £24 ($30) / month (after a 10-day trial)

Course link: Deploying Microsoft Azure Synapse Analytics and Azure SQL Database

Course length: 1 hour 57 minutes

A core focus of this Pluralsight course, instructed by Robert Lindley, is to place SQL querying within the context of Azure SQL Databases, and it also covers Azure Synapse Analytics. The course addresses deploying these Azure resources, particularly as part of a CI/CD (Continuous Integration/Continuous Deployment) process using Azure DevOps. 

This relatively short and highly focused course aims to equip students with the skills to effectively deploy Azure SQL Databases and Azure Synapse Analytics (formerly Azure SQL Data Warehouse) within an Agile development framework.

SQL for Data Analysis: Beginner MySQL Business Intelligence

Best SQL courses for business leaders

Provider: Maven Analytics (via Udemy)

Price: £59.99 

Course link: SQL for Data Analysis: Beginner MySQL Business Intelligence

Course length: 4 hours 30 minutes

For businesses that need to understand how their data can influence strategic planning, this course from Maven Analytics offers an excellent foundation to build knowledge and skills. The course uses MySQL and MySQL Workbench to guide students in developing SQL queries, including the creation of MySQL JOIN statements for working with multiple tables. 

The real-world business cases and practical exercises characteristic of Maven Analytics' courses make this learning highly valuable for all business leaders and aspiring analysts looking to leverage data for decision-making.

The Complete SQL Bootcamp: Go from Zero to Hero

Best for comprehensive PostgreSQL learning from a top instructor

Provider: Jose Portilla (via Udemy)

Price: £89.99 (UK Price). Typically around $129.99 (Note: Udemy prices fluctuate frequently with sales; this is a common non-sale price, but significant discounts are very frequent.

Course link: https://www.udemy.com/course/the-complete-sql-bootcamp/

Course length: Approximately 9 hours of on-demand video (current listing is 9h 6m).

This perennially popular Udemy course, instructed by leading data science and programming instructor Jose Portilla, is designed to take absolute beginners to a confident level of SQL proficiency using PostgreSQL. Its comprehensive curriculum covers everything from basic SQL syntax, data manipulation (SELECT, INSERT, UPDATE, DELETE), and database creation to more advanced topics, such as GROUP BY statements, conditional expressions, JOINs, subqueries, and data type management.

A key strength of this bootcamp is its clear explanations and numerous practical exercises and challenges that allow students to apply what they've learned immediately with a widely used open-source database. The course structure is logical and progressive, making complex concepts accessible. Given its high ratings, extensive student base, and the instructor's reputation, it's a trusted choice for individuals looking to build a solid and practical foundation in SQL with PostgreSQL, a skill highly valued in various tech roles.

SolarWinds has announced that its DBA xPress solution is now free for all users.

In addition to automating data and schema comparisons, DBA xPress simplifies Microsoft SQL Server cloud migrations.

With its built-in SQL capabilities, DBA xPress lets data analysts assess dependencies and connections between tables, users, and functions, among other database parameters.

“As digital transformation continues to accelerate across industries, we’re seeing more businesses start to prioritize their move to the cloud. But as teams—especially database managers—start to break down cloud migration requirements, it quickly becomes apparent how time-consuming and costly it can be,” explained Rohini Kasturi, chief product officer at SolarWinds.

Kasturi continued, “To succeed in migrating from one environment to another, teams need to optimize their data to maximize the performance of cloud-hosted databases and adopt solutions that enable DataOps practices to drive efficiency and productivity. We’re hoping to kickstart and simplify this optimization process for DBAs, DevOps teams, tech pros, and business leaders alike by offering DBA xPress for free.”

Object Browser, which is available within DBA xPress, lets users explore and filter all objects within a schema, including tables and primary key constraints. With Data Surf, analysts can generate diagrams of parent and child tables, zoom in and out, customize table nodes, and more. The Data Space Analyzer offers insights into available database disk space.

Additionally, users can automate schema and data synchronization via the command-line interface (CLI). Businesses can also perform scheduled data comparisons between production and development environments.

“As more organizations seek the benefits of DataOps strategies, it’ll be imperative in the near term to deliver value through data. DBA xPress will help tech pros tackle this head-on—for free—and help them move one step closer to implementing a successful DataOps strategy,” added SolarWinds.

By now, the fact that data is the most important commodity for a modern business is old news. The value of data and the need for a solid data strategy is well established, and the benefits speak for themselves. However, one aspect that often gets overlooked in conversations about data-driven business is that this information needs to pass through a database in order to start generating value – and it’s here that many organisations run into trouble.

Running a database can be tricky, especially once you start scaling to multiple regions or high volumes of transactions being processed at the edge. There are countless ways in which an inexpertly configured and maintained database can start developing problems, most of which can have a significant impact on performance and availability. Here are some of the top problems that can creep into databases – as well as what to look out for and how to solve them.

Data ingestion

This may sound obvious, but in order for a database to be valuable, it needs to be able to ingest data – and this process can present its own problems for unwary organisations. For example, you need to think about what sources your data is coming from, and any integrations that may be required in order to get it from those sources into your database. These connections may require additional resources to build and operate, and their health needs to be monitored in order to prevent bottlenecks.

Another concern is at what speed data needs to be ingested – real-time data processing sounds attractive, and can be hugely advantageous for certain applications, but for databases which aren’t accessed regularly or where the contents aren’t time sensitive, real-time ingestion may be introducing unnecessary complexity and slowdown when batch processing would have been just as effective.

These issues can be circumvented by planning out and documenting the details of your database architecture as early as possible. As part of this, DBAs should also be thinking about what kinds of data they’re ingesting into a given database; for example, if you’re building a customer database to serve a mailing list, you can probably stick to basic details like name and email address, without worrying about age, physical address, height and shoe size. The smaller your database is, the faster it will run.

Database size

As we mentioned above, a lean database is a fast database – and by the same token, a larger database will perform increasingly poorly over time. This can often happen without being noticed, which is why it’s important to conduct regular audits and health checks on your database, both to monitor the size and to make sure that it doesn’t contain any unnecessary data.

Of course, what counts as ‘unnecessary data’ will differ from one organisation to another, and organisations should have specific policies governing what data to collect, which databases to house it in and how long to keep it for. Not only does this help keep the size of databases down by allowing for old data to be cleared through rules-based automation, it also helps organisations maintain a good compliance posture when dealing with personal information.

Query optimisation

One of the most pervasive problems that affects databases is poorly-constructed queries. This is sometimes the result of gradual tweaking as a database evolves over time, other times the queries were badly written from the word go. Whatever the reason, an inefficient query can have major impacts on performance and stability.

There are a few common culprits to look for when troubleshooting underperforming queries. For example, it may be using too many join operations, or be structured in such a way that it’s performing full index scans for a relatively simple task. While you can manually comb through your database operations looking for inefficiencies, this can be a long and time-consuming task for DBAs.

It’s often much simpler to use utilities like Quest SQL Optimizer, which can automate much of the process. Tools such as this allow you to scan your database environment for potentially inefficient SQL statements, test alternatives to determine relative performance and restructure indexes to improve overall database speed.

Database security

The database is the crown jewel of any organisation’s IT. It’s the place where your customer records, financial information, access credentials and any amount of other valuable information is kept – which makes it a tempting target for hackers. Unfortunately, databases are also one of the elements of a company’s infrastructure which is most prone to developing security holes as it grows. Therefore, it should be among the top priorities for security teams to protect.

We’ve already covered the importance of regular auditing from a database health perspective, but it can also have a big impact on security. With Quest’s Change Auditor, admins can track data-level events such as changes to rows, triggers and tables, as well as alterations to access permissions - another area that must be closely monitored in order to ensure good security.

Resource consumption

According to Gartner, three-quarters of all databases will be deployed in the cloud by next year, but while cloud can be great for simplifying the operation and maintenance of your databases, that doesn’t mean that you can forget about hardware capacity and configuration altogether. If you’ve over-estimated the compute and storage needs of your cloud database in the initial planning stages, it’s easy for running costs to rapidly spiral. Similarly, if the needs of your database change over its lifetime, you may find that capacity has to be expanded as your database grows.

This is why it’s important to keep a close eye on the performance and resource consumption of cloud databases, optimising your storage, compute and networking configuration periodically to ensure that costs and performance are matching up to expectations. Tools like Quest Foglight Evolve can help organisations to set more accurate estimates of necessary cloud service tier requirements prior to migration of a virtual machine or container on which the database resides, and costs of that workload can be easily tracked on an ongoing basis once a migration has been completed, all within Foglight.

A quarter of a million databases stolen from tens of thousands of breached MySQL servers are being offered for sale on the dark web, according to security researchers from Guardicore Labs.

Hackers are believed to have obtained 7TB of stolen data using the PLEASE_READ_ME ransomware campaign, successfully targeting around 83,000 MySQL database servers.

PLEASE_READ_ME has reportedly been active since January 2020, attacking weak credentials on internet-facing MySQL servers.

Since then, Guardicore Global Sensors Network (GGSN) reported 92 attacks, with numbers rising sharply in October. According to Guardicore researchers, the ransomware attacks originated from 11 different IP addresses, most of which were found to be located in the UK and Ireland.

The ransomware campaign is untargeted, meaning that it attempts to infect any of the five million MySQL servers which are internet-facing. Hackers exploit weak credentials and are able to re-access the network by leaving a backdoor user on the database for persistence.

Guardicore Labs researchers managed to discover two different variants during the lifetime of this campaign. The first, which lasted from January to the end of November, saw attackers leaving their victims a ransom note with their wallet address, the amount of Bitcoin to pay, as well as an email address for technical support, with 10 days being given to make the payment.

The second variant, which began on 3 October and also lasted until late November, got rid of the Bitcoin wallet payments and email communications. Instead, hackers opted for a website in the Tor network to receive payments and used unique alphanumeric tokens, outlined in the ransom notes, to identify the victims.

In a blog post detailing the discovery, security researchers Ophir Harpaz and Omri Marom said that the “PLEASE_READ_ME operators are trying to up their game by using double extortion in scale”.

“Factoring their operation will render the campaign more scalable and profitable. Guardicore Labs provides an IOCs repository and will keep monitoring this campaign to help organizations protect against it,” they added.

Cockroach Labs just released CockroachDB 20.2, the latest version of its cloud-native, distributed SQL database. It includes new capabilities for spatial data, a new CockroachDB for Kubernetes option, and enterprise backup and restore functions for free users.

The open-source and freely available CockroachDB is the first cloud-native distributed database to include spatial data types and associated libraries. It’ll support net new workloads for Internet of Things (IoT), transportation and environmental applications, and includes a geodistributed database with geospatial capabilities. The syntax is compatible with PostGIS, an open-source software that adds support for geographic objects to the PostgreSQL object-relational database.

CockroachDB on Kubernetes combines the cloud-native database with a custom operator optimized for orchestrated deployments. Its distributed, share-nothing architecture enables users to attach storage however they want, as CockroachDB manages the scale, resilience and distribution of data. The included Kubernetes operator simplifies deployment configuration and ensures no-downtime rolling upgrades in production.

The CockroachDB 20.1 update brings basic distributed backup and restore features that were previously available only in the enterprise version to CockroachDB Core, the free, open-source version of the database.This update ensures companies’ disaster-recovery plans are in place and they can freely build high-performing production applications.

The latest version of CockroachDB extends its TPC-C benchmark performance to 140,000 warehouses, improving its throughput to 1.7 million transactions per minute (tpmC), a 40% improvement versus 2019. The TPC-C benchmark serves to simulate e-commerce or retail environments.

CockroachDB 20.2 other updates include:

• The introduction of Pebble, an open-source storage engine that provides performance and stability improvements, in place of the old storage engine.
• The database’s new monitoring UI displays key troubleshooting metrics for developers to query performance, including an SQL transactions page and a database sessions page.
• It adds new SQL functionality, such as partial indexes, materialized views, enumerated types, and user-defined schemas.
• It gains enterprise-grade security with logging, Role Based Access Control (RBAC) and certificate management.
• Adds support for Java tools Hibernate, MyBatis, Spring Data JPA, and Spring Data JDBC; and the Ruby tool Active Record.

"We're committed to making CockroachDB the database of choice for developers everywhere," said Spencer Kimball, CEO and co-founder, Cockroach Labs. "We've listened to our users, and we've made improvements to all areas of the database, including a new package, CockroachDB on Kubernetes, to ease deployments in cloud-native environments. No matter what the use case, we want to equip every developer with the database they need to build and create their business's next billion-dollar idea."

Comcast, DoorDash, eBay, Nubank, JPMorganChase, SpaceX, and hundreds of other companies use CockroachDB for transactional cloud-based applications. CockroachDB builds on the traditional relational databases PostgreSQL and provides elastic scale, indestructible resilience and low-latency distributed performance.

"LaunchDarkly empowers development and business teams to control their software. Our customers depend on our services to be available, fast, and correct from anywhere on the planet," said Justin Caballero, senior distributed systems engineer at LaunchDarkly. "We chose CockroachDB for our next gen database because of its consistency and flexibility, and the control it affords over our data."

Google has launched an early version of BigQuery Omni, its new analytics tool that lets users access and view data across Google Cloud and Amazon Web Services without leaving the Big Query UI.

Powered by Google Anthos, its vendor-neutral app development platform, users will be able to use SQL and the standard BigQuery APIs to manipulate data silos sourced from multiple platforms, without having to manage the underlying infrastructure.

Although the initial alpha launch of the service is restricted to Google Cloud and AWS, Google has also confirmed that Microsoft Azure will eventually be supported.

The tool has been designed to target those customers who rely on multiple cloud service providers and are forced to juggle and consolidate a number of analytics tools in order to get a view of their data.

This is made possible by the decoupling of storage and compute, according to the firm. The compute side has always been regarded as ‘stateless’ but, until now, BigQuery required data to be stored in Google Cloud – this restriction has now been scrapped, allowing customers to store their data in any supported public cloud.

This single view means that customers can use BigQuery Omni to run SQL queries on clusters in whichever region the data resides. For example, it will be possible to query Google Analytics 360 Ads data stored in Google Cloud while simultaneously querying logs data from any apps stored in AWS S3. This can then be used to build a dashboard to get a complete view of audience behaviour alongside ad spend.

This means customers can avoid any costs associated with moving or copying data between cloud platforms in order to get a full view, Google claims.

“85% of respondents to 451 Research’s Voice of the Enterprise Data & Analytics, Data Platforms 1H20 survey agreed that the ability to run the same database on multiple cloud/data centre environments is an important consideration when selecting a new data platform,” said Matt Aslett, research director, Data, AI and Analytics, 451 Research.

“As hybrid and multi-cloud adoption has become the norm, enterprises are increasingly looking for data products that provide a consistent experience and lower complexity of using multiple clouds, while enabling the ongoing use of existing infrastructure investments," he added.

The new system is built using Anthos, an app development platform launched last year to appease customers that wanted a single programming model that allowed for data to be moved between their various cloud providers without charge or requiring changes.

The underlying infrastructure is run entirely by Google, including any communication between cloud providers, on the familiar BigQuery UI, so there will be little operational change from the customers’ perspective, the company claims.

BigQuery Omni’s engine will run on Anthos clusters inside the BigQuery managed service, and will source data from the various data silos across a customer’s public cloud services, provided they have provided authorisation. In order to run queries, data is temporarily moved from the cloud provider’s data storage to the BigQuery cluster running on Anthos.

For now, BigQuery Omni is only available in private alpha, so customers will need to apply to Google to use it if they’re interested. It’s also only available for AWS S3 for now, with Azure support coming soon.

There is currently no general release date available.

Businesses at the top of their respective industries all have one thing in common: the knowledge that data, both structured and unstructured, forms the heart of their organization and is key to their success.

A comprehensive and nuanced data strategy is therefore vital.

Creating one, however, is not an easy feat. It isn’t just a matter of dealing with all the sources of data; it’s also having expertise in the tools required to manipulate and process that data and understand what needs to be structured and where a rigid model is inappropriate.

Do you have people that are experts in Excel, SQL, NoSQL, PostgreSQL and Oracle? Does your business have a suitable data lake so all corners of the company can benefit from the data itself and generate their own specific insights?

If you answered ‘no’ to any of these, then your data management strategy might not be up to scratch. How you feed that data into your business, or data lake, is up to you. But understanding how to store that data - either in a structured or unstructured manner - is crucial in making that next big step in your business’ journey to the top.

What is structured data and how is it managed?

When it comes to databases, structured data is often what first comes to mind.

Structured data - also known as relational data - is stored in tables with columns and rows. The structure is described by a schema, with relationships defined between the tables. For example, one table might contain a list of customers, another table might contain a list of telephone numbers with one row in the customer table potentially having many connected rows in the telephone numbers table.

Structured data is, by its very nature, already “managed”. The definition of the tables and columns means that data must be kept in an orderly fashion. Constraints can be added to the columns to, for example, ensure that only numbers are entered for telephone numbers and that no telephone number can be added without an associated customer.

The structured approach to data storage has both benefits and drawbacks. Users are able to understand and access data easily, with a wide variety of tools for querying and analysis available. However, it can also be regarded as highly inflexible when the data needing to be stored does not fit the structured data model.

It's also worth noting that a relational database management system (RDBMS) is often embedded in products that also offer far more bells and whistles than just managing data and making it available to queries.

For example, Salesforce, the cloud-based customer relationship management (CRM) platform, manages the structured data put into it, but also offers tools like chat, access to the Force.com development platform, analytics, and so on.

What is unstructured data and how is it managed?

Unstructured data is anything that can't be organised into a structured database. Common examples are free-flowing text-based interactions, such as email conversations or chat logs, word processing documents, slideshow presentations, image libraries, or videos.

Estimates vary for how much unstructured data lies in business. One recent projection estimated that 80% of global data would be unstructured in the near future. 

It contains a wealth of corporate information but, by its nature, was difficult to access until modern big data analytics and AI have become a reality.

Together with structured data, it's also one of the three Vs of Big Data variety (the other two being velocity and volume).

There are many benefits to using unstructured data. It is rapid to accumulate and there is no need for time-consuming parsing since there is no predefined structure. It can also be stored in its native format and lends itself well to corporate data lakes.

However, the benefits can also be pitfalls; specialized skills and tools are required to analyze unstructured data and users can be left alienated when faced with data that does not adhere to a uniform format.

Common tools for dealing with unstructured data (also referred to as NoSQL) include MongoDB and DynamoDB.

Unstructured data management (UDM) is essential for successfully making use of all this data. Rather than there being a handful of tools to point to for UDM, there are instead some basic tenets to be followed, which we outline below.

Indexing

This term, sometimes known as "discovering" as well as other related terms, means compiling your data to really see what's there, how frequently it is accessed, for how long it has existed, and more. 

The objective of indexing is to find out whether this information will potentially bring future value to the organisation and see if it is worth putting in an UDM system and archiving it.

This, however, can be a long process, and can take many weeks to sift and scan all the data. Be ready to dedicate a lot of effort and time to this process in the initial stage. This is also the section where you should add metatags so that the data is easy to search later on in the process.

Storage and availability

Now that the data has been organised, it now requires storing in a suitable location with the correct attributes that make it automatically and easily accessible.

There are a number of storage locations to choose from, which includes general cloud storage like Microsoft Azure or AWS S3 or on-premises data lakes. When the information resides here, it is able to be stored in its "natural" state, which means there is no need to store it in a database format, but also allows it to be available for automated querying through APIs.

When thinking about which type of storage to utilise, it's worth considering how frequently the data that is being stored is accessed. For example, if it's relatively frequent, it might need to be put in "cold" storage, which is usually much cheaper than if it is kept in storage that makes the information accessible at all times. However, in this "cold" storage it will be slower to access initially when you do need to sift through it and query it.

Semi-structured data

Semi-structured data can be regarded as a “halfway house” between structured and unstructured data. While it does not have the predefined model of structured data, it is easier to store and work with than unstructured data.

Examples of semi-structured include JSON or XML. Although the columns and definitions of traditional structured data are not usually present, the data does contain tags and markers to separate elements, making for simpler querying. These tags and markers are referred to as “metadata” and mean data can be better catalogued.

Vector databases

Also found in the category of unstructured data  - although increasingly meriting a section of its own - and becoming progressively more popular in the era of generative AI, are vector databases.

As with unstructured data, pretty much anything can be dropped into the database. However, an embedding function encodes the data into vectors to capture its meaning and context. The result is something that can be searched based on similarity or vector distance.

An example would be searching for an image based on content or style. Or a large language model (LLM) generating more relevant and coherent text.

Examples of vector databases include Pinecone and Weaviate.

What do Microsoft, Apple, Accenture, Skype, Reddit, Twitch, Spotify and the International Space Station all have in common?

Despite being very different companies working in a range of sectors, they all run essential workloads with the same open source database system: PostgreSQL.

PostgreSQL is considered to be the most sophisticated open source database system. It was launched over 25-years-ago as the successor to the Ingres databases, which was developed in the 1970s by a team of scientists from the University of California.

Now, while the original PostgreSQL is a free and open source relational database management system, there is also Azure Database for PostgreSQL, which is a tool that allows users to build massively scalable PostgreSQL apps. It's based in Microsoft's flagship Azure cloud service, and makes it possible to develop apps using PostgreSQL tech without actually needing to take full control for the instances. It's also available in different deployment modes and can be on-premises on any infrastructure the customer likes.

To fully understand how versitle Azure Database for PostgreSQL is, we need to break down its tiers and pricing models.

Deployment types for Azure Database for PostgreSQL

Azure Database for PostgreSQL – Single Server

The main deployment method for PostgreSQL databases on Azure is the Single Server model, and very closely resembles the conventional PostgreSQL. Users can also take advantage of the on-premise version to create a single PostgreSQL server as the main host for multiple databases.

The Single Server model also offers a fully managed service that can boast 99.99% performance guarantee, and includes several additional features, such as encryption.

This configuration can also be handled through the Azure portal as well as the Azure command line interface (CLI), as can the majority of Microsoft’s cloud services. The Single Server deployment can also let developers have a single database per server, which means they can make the most of resource usage and even share resources across several databases.

Administrators on Azure Database for PostgreSQL don’t always have full superuser permissions, unfortunately, with the highest privileges available going to the azure_pg_admin. The managed service will always retain the superuser attributes, assigned to azure_superuser, and regular users aren’t able to access this role or its privileges.

Azure Database for PostgreSQL - Hyperscale (Citus)

If you have a database which is over 100GB and requires maximum performance, you might want to consider Azure's newest PostgreSQL deployment model. Also known as the 'Hyperscale (Citus)' hosting type, this method uses technology from Citus Data, a company that Microsoft acquired in January 2019.

Hyperscale (Citus) uses database sharding technology, which splits data into smaller component parts and distributes them across a large number of compute nodes which are grouped together into a cluster. This cluster offers more storage capacity and CPU utilisation than a standard single-server PostgreSQL deployment would be able to.

Big companies like Facebook and Google use database sharding within their data centres, but one of the advantages of Hyperscale (Citus) is that sharding is handled automatically, without the tenant application needing to be taught how to do it. The system parallelises SQL queries and other operations across available servers, with a central 'coordinator node' handling query routing, aggregation and planning, and 'worker nodes' storing data.

When the coordinator receives a request from the application, it routes the query to the relevant worker node(s), depending on where the data in question is stored. Caveat emptor, however; as Hyperscale (Citus) is in public preview, it does not offer an SLA at the time of writing.

How much does Azure Database for Postgresql cost?

There are three pricing tiers available for the single server version of Azure Database for PostgreSQL, with each setting out the various provisions that a customer may expect from these packages. These are termed Basic, General Purpose, and Memory Optimised.

While all tiers offer computing power provisioned in virtual cores, or vCores, and each uses fifth-generation chips based on Intel’s Broadwell 2.3 GHz processors, the number of cores and the memory available varies.

The entry-level tier, for instance, offers either one or two rentable vCores, combined with 2GB memory, for £0.026 per hour and £0.051 per hour each. General Purpose and Memory Optimised configuration both offer far more memory and vCores, and are priced more steeply, with the maximum configuration available for £4.179 per hour.

Elements of the servers’ configuration can be changed and adjusted after they’re established, however, and there are a number of factors that combine to influence how much the system will end up costing. You could, for example, ramp up the number of vCores deployed, the storage capacity, and the length of time that backups are retained. Users can also interchange between the different pricing tiers, between General Purpose and Memory Optimised setups, for example.

The final pricing also depends on the type of package you take out and how you want to pay for it, whether it be pay-as-you-go, or annual billing, which generally cost less as you pay more upfront. This annual discounting is not available on the basic level, however. The full breakdown of available tiers is listed below, with fuller pricing information available on through Microsoft.

Understanding the pricing tiers

Single Server

Flexible Server

Hyperscale (Citus)

Each tier provides a free back up of up to 100% of your provisioned server storage. You can increase your backup retention period, however, this will increase the amount of backup storage consumed by the server, and so you will be charged extra.

Basic

The entry-level tier is primarily designed for low-priority workloads that don't require a great deal of performance. This can include test/dev environments or intermittently-accessed applications.

General Purpose

As the name suggests, the general-purpose tier is where most workloads will naturally fall, and encompasses most enterprise PostgreSQL use-cases. It offers a balance of performance and economy.

Memory Optimised

The highest tier is reserved for applications like financial transaction databases or analytics engines where low latency is paramount. For this reason, it makes heavy use of in-memory computing.

While the Basic tier does not provide an IOPS guarantee, other tiers have IOPS scale with the provisioned storage size in a 3:1 ratio.

Burstable

Somewhat self-explanatory, this pricing tier is exclusive to the Flexible Server deployment and is best suited for businesses that make use of cloud bursting to optimise their resource usage.

Standard

This pricing tier is only available with Hyperscale (Citus) deployments and covers different variables such as worker node size, coordinator node size, and storage per node.

Benefits of Azure Database for PostgreSQL

The database cloud service has a number of advantages.

Built-in high availability: The service provides built-in high availability with no additional setup, configuration or extra cost. This means there is no need to set up further virtual machines and configure replication to guarantee high availability for a PostgreSQL database.

Security: All data including backups are encrypted on disk by default. Also, the service has SSL enabled by default, so all data in-transit is encrypted.

Scalability: The service allows users to scale compute on the fly without application downtime in one step.

Automated backups: Users do not need to independently manage storage for backups. The service offers up to 35 days retention for automated backup.

SQL injection (SQLi) remains a major cybersecurity threat, allowing attackers to manipulate databases, steal sensitive data, and disrupt services at organizations of all sizes, despite being well-documented for many years.

“SQL injection is perhaps the best understood class of vulnerability across security professionals. SQL injection has been around for nearly 30 years and is often highly impactful. An innocent field on a web page can let an attacker extract or modify the entire backing database, or even allow the attacker to run code as the database server,” the UK National Cyber Security Centre (NCSC) wrote in a blog post in December 2025.

It continued: “SQL injection is also conceptually attractive as it's illustrative of a recurring problem in cybersecurity; that is, ‘data’ and ‘instructions’ being handled incorrectly. This allows an attacker to supply ‘data’ that is executed by the system as an instruction. It's the same underlying issue for many other critical vulnerability types that include cross-site scripting and exploitation of buffer overflows.”

While SQLi occurrences have declined, they remain a persistent risk. In 2024, SQL injection accounted for 6.7% of vulnerabilities in open-source projects and 10% in closed-source applications – a 14% and 17% decrease from 2023, respectively, according to Aikido Security, but still a threat.

Even widely used services are vulnerable. In an interview, Troy Hunt, founder of Have I Been Pwned, highlighted a recent breach caused by SQLi in a password reset form, occurring in January 2025.

Hunt says that the landscape has “definitely improved due a combination of factors such as frameworks automatically parameterising queries and the emerging prevalence of easily accessible WAFs like Cloudflare, but we do still see plenty of incidents as a result of SQLi.”

How have SQLi attacks been used?

SQL injection remains a major attack vector for cybercriminals, with recent breaches demonstrating its ability to cause large-scale damage.

In June 2023, attackers exploited an SQLi vulnerability in MOVEit, a managed file transfer software used by businesses and government agencies, leading to the theft of sensitive data from nearly 100 million individuals, affecting banks, health care providers, and educational institutions worldwide. The sheer scale of the attack highlighted how a single SQLi flaw can result in devastating consequences across multiple industries.

To take another example, in mid-2024, a similar vulnerability was discovered in FileCatalyst Workflow, an enterprise file transfer solution, that let authenticated users modify the database through SQL injection during the setup process.

While the vulnerability required user authentication, it demonstrated the dangers of SQLi being exploited internally, either by malicious insiders or attackers who had already gained initial access, and reinforced that SQLi isn’t just an external threat; companies must also secure internal applications to prevent unauthorized database access.

Hunt has seen firsthand how SQLi continues to be exploited. “One of the most recent breaches listed in Have I Been Pwned was caused by SQL injection on a password reset form,” he explains.

He emphasised that preventing SQLi is not just about securing login pages but also protecting any input field that interacts with a database. When asked about common mistakes, Hunt said it was “definitely a lack of parameterisation of untrusted data. Arguably, there should also be better sanitisation on input, but parameterisation heals all mistakes.”

Beyond data breaches, SQLi can manipulate or destroy entire databases, leading to financial loss and operational disruptions. Attackers can modify records, erase critical business data, or even shut down entire systems, causing long-term damage. Despite widespread awareness of SQLi, many companies still fail to prioritize secure coding, relying on outdated security measures that leave them exposed.

How to defend against SQLi attacks

SQLi remains a serious security risk, but organizations can take several steps to mitigate it. Many attacks succeed because of poor coding practices, particularly when developers fail to secure database queries against malicious input.

SQLi vulnerabilities often arise when applications allow unchecked user input to be executed as part of a database command. Addressing this requires secure coding techniques, proactive security testing, and the use of modern security tools.

One of the most effective ways to prevent SQLi is through parameterized queries and prepared statements, which ensure that user input is treated strictly as data rather than executable code. Web application firewalls (WAFs) also play a role in mitigating SQLi attacks by filtering malicious traffic.

While WAFs do not fix the underlying vulnerability, they can be highly effective in blocking real-world exploitation. Hunt emphasises this point, explaining that a WAF that inspects inbound traffic can stop SQLi attacks even if the core issue remains unresolved. “[WAF] doesn’t fix the underlying vulnerability, but it’s very effective at stopping it from being exploited,” he said.

Security testing is another essential defense against SQLi. Regular security audits and penetration testing help organizations identify vulnerabilities before they can be exploited. Asked about what to do, Hunt says companies should “invest in infosec training for software developers and engage professional penetration testers. Paid bug bounties are also a great way of helping the good guys find vulnerabilities before the bad guys do.”

While automated tools can help detect SQLi vulnerabilities, prevention ultimately depends on developers writing secure code.

Are we doing enough?

Despite progress in reducing SQLi vulnerabilities, SQLi remains a persistent threat.

The FBI and CISA have repeatedly warned that organizations must do more to eliminate these flaws, emphasizing that poor security practices continue to expose critical systems. While many modern frameworks provide built-in protections, vulnerabilities still appear due to legacy code, poor developer training, and inconsistent security enforcement.

Hunt acknowledges the improvements made over time but stresses that SQLi is still a real and active risk. “We’ve seen a lot of progress over the last couple of decades,” he says, “but clearly it’s still being exploited, and we need to remain vigilant.”

Many businesses remain vulnerable because they prioritise functionality over security, leaving database protection as an afterthought. Security best practices such as parameterized queries, web application firewalls, and penetration testing are essential, but they require ongoing investment and awareness.

Ultimately, defending against SQLi requires more than just technical fixes: it demands a security-first mindset at every stage of development. Developers, security teams, and business leaders must work together to prioritize secure coding practices, conduct regular security assessments, and stay informed about emerging threats.

As long as SQLi continues to be exploited, businesses cannot afford to become complacent. The tools and knowledge to prevent SQLi exist, but only a proactive and consistent approach will ensure that these vulnerabilities are truly eliminated.

Databases are the cornerstone of any business; they're used to track purchase orders, catalogue customers and manage employee payrolls. On top of that, basically every web technology is built on a back-end database.

The most common form of database within IT is the relational database. These are coded using SQL (pronounced 'sequel') which stands for Structured Query Language. These databases require specialised software to manage, examples of which include Oracle Database, Microsoft's SQL Server family, and PostgreSQL.

Relational databases were first developed in order to standardise the way that databases were constructed and maintained. Prior to this, the way databases were structured and navigated often differed from one to the other, making them hard to develop applications for without being deeply familiar with the database in question.

In order to make this task - and the general process of working with databases - more efficient, relational models were developed to provide a universal, standardised format for databases. These were easier to maintain, more versatile and quicker to learn how to work with.

How do relational databases work?

Relational databases are comprised of multiple interconnected tables which are linked by a shared value. These shared values are identified by 'keys' - the column or columns within a table which contain values which are shared between multiple tables. These keys help the database understand which row of values to pull from each table when handling queries. The primary key is usually the first column within a table, although a table can contain multiple subsidiary keys, or 'composite keys' comprised of multiple combined columns.

Let's look at an example, from a fictional restaurant delivery company that wants to offer UK customers who have been premium subscribers for over a year a voucher for their favourite food as a reward. Their database contains two relevant tables - one with customers' personal details, and one with their subscriber information, as shown below.

Personal details

Subscription details

In order to establish which customers are eligible and to send them the offer, the company needs to establish their name, email address, country, membership tier, the length of their membership and their favourite food. They can do this by using the database's key - which in this case is the email address - to cross-reference the two tables with one another.

This allows the database to establish that, because he has been a premium member for a year and a half and lives in the UK, John Smith is eligible for the reward, as well as allowing it to automatically send a personalised email to him containing a voucher for his favourite burger restaurant.

Relational database schemas

Relational databases are organised according to specific schemas - predefined rules governing how tables are laid out, including what data is contained in each column and the order they come in, as well as which columns are used as keys.

Schemas can be coded in SQL or laid out in charts and graphics. The schema's specifics will differ from database to database, but the format is standardised enough that it's easy to go from working with one schema to another, making them simpler to develop applications for.

Advantages of relational databases

The primary advantage of relational databases over earlier non-standardised methods of database architecture is the high degree of consistency they offer. Relational databases are both internally consistent - ensuring that data is easy to find, because it's formatted and laid out in a uniform way - as well as being much more interoperable with each other due to their use of pre-set schemas.

Relational databases are also rules-based, meaning that you can manage and edit large databases by creating global parameters and applying them to every record and table within a database. Additionally, because the databases themselves are independent of the physical storage on which they reside, database architects can alter the infrastructure the database runs on without affecting its logical integrity.

These databases also have certain advantages over newer database architectures such as NoSQL (which we'll discuss further in a moment). Relational databases tend to be more stable and consistent than their non-relational counterparts, and they're often better-suited to complex queries. The relational model also benefits from a much greater wealth of support resources, information and skilled professionals, due to its longer history.

Relational database alternatives

In recent years, the dominance of the relational model has been challenged by the emergence of non-relational 'NoSQL' databases, typified by providers like Couchbase and MongoDB. NoSQL databases (predictably) do not use SQL, and are instead built using object-oriented programming languages like Python, Ruby, Java and C++.

These databases are predominantly built to handle massive scale, and have found particular popularity as a tool for big data storage and analysis. The main advantages NoSQL offers over relational databases are that NoSQL databases can be expanded horizontally by adding more nodes of commodity hardware, and that they are designed to allow unstructured data, whereas relational databases demand rigid formatting.

Experienced IT professionals will more than likely have encountered SQL (Structured Query Language) and understand what it is. Commonly pronounced as ‘sequel’, SQL is one of the most widely-used programming languages for managing databases.

SQL is particularly useful for handling structured data in relational databases, where the information in one table is connected to information in another.

There are a number of benefits to using SQL as a programming language. Given that multiple records can be accessed with a single command, this makes it a much faster tool to use compared to legacy read/write tools such as ISAM or VSAM.

SQL is based upon tables and rows, with each query requesting information from a data set housed in each of these tables - or rows within tables.

What is SQL?

The concept of SQL was first developed in the 1970s by Edgar F. Codd, a pioneer in relational database management. He wanted to create a system that would make it easier to manage shared databases.

IBM computer scientists Donald D. Chamberlin and Raymond F. Boyce picked up on the theory behind Codd's research and began developing the concept, using it to query information within System R, the company's semi-relational database.

First known as SEQUEL (Structured English Query Language), IBM continued to evolve the technology and, in 1979, Oracle (previously called Relational Software) released the first commercialised version of the system.

What elements comprise SQL?

SQL language consists of a number of separate elements, all of which comprise a 'statement'. Statements, or queries, start with a term like SELECT or CREATE, and finish with a semicolon, indicating the end of the query.

Here are the elements that you typically find in SQL language:

• Clauses - the individual components of a statement; like 'UPDATE' or 'WHERE' - these set the nature of the query
• Predicates - these specify conditions that can change the scope of the query: for instance, stipulating either 'BETWEEN' or 'ALL' will give you different datasets; the former, a range between x and y, or the latter, the entire data that fits your query.
• Expressions - expressions can produce scalar values (a storage location paired with an identifier) or tables, containing columns and rows.
• Queries - these retrieve data relevant to the criteria you define.
• Statements - statements are the way queries are sent from your SQL software to the database server. They start with a term like SELECT or CREATE, (your clause) and finish with a semicolon, indicating the end of the query.

Common SQL queries

Codecademy put together a useful list of common SQL queries that demonstrate how SQL is used to query and manipulate data. We've used some examples below:

• ALTER TABLE - this lets you add new columns to a database, increasing the kinds of data it can record.
• CREATE TABLE - adding a new table lets your database store a whole new type of data.
• ORDER BY - this is a useful command to ensure the data you query is presented in a useful manner - for instance, alphabetically.
• UPDATE - updating a database lets you alter rows, say for instance if the data has changed, or you've found it to be incorrect

SQL servers

Most IT professionals are more likely to interact with SQL via the database server software it powers than the language itself. SQL powers database software such as Oracle Database, MySQL, PostgreSQL and Microsoft's venerable family of SQL Server products.

SQL database servers have been around for decades, and many businesses rely on them to power their applications. Due to their age, SQL databases also have a much greater bedrock of community support resources available.

Some organisations choose to use NoSQL databases rather than SQL, which is seen by some as being more scalable than SQL servers due to the ability to add more nodes. NoSQL is non-relational, and does not require a predefined schema for its databases. MongoDB and Couchbase are both examples of NoSQL servers.

SQL data manipulation

SQL's ability to change and edit data makes it an incredibly useful programming language. Rather than simply storing data, you can issue commands to change it when necessary. Data isn't often very useful when it's out of data, so being able to update your database to keep your data accurate is essential.

SQL Security

One of the most pervasive types of cyber attack facing businesses is the SQL injection attack.

SQL injection attacks allow cyber attackers to view, modify, delete, or otherwise access the data held in these databases if they are relied upon by vulnerable websites or web applications.

Typically targeting websites or web apps which both rely on SQL-based databases and use web forms for various user functions, cyber criminals can exploit vulnerabilities in these websites or apps to query the back-end database for themselves.

They can also knock services offline using the same method, if data theft isn’t their game.

Web forms are used for a variety of purposes but one of the most common uses is for login pages where users enter their usernames and passwords. A website or web app then uses the information taken from these fields, cross-references it with the data in its SQL database and, if the two credentials match, then the user can access their account.

SQL injection attacks see hackers submit specially crafted lines of code in these input fields in an attempt to submit their own query to the database and access it in the way they want. Many web forms are set up to prevent SQL injections from being possible - they’re coded so they only accept valid username and/or password characters.

However, some web forms are not set up as securely and can allow attackers to inject their custom code which often leads to the theft of data.

IBM and WANdisco have developed relational database technology to extend IBM Big Replicate (WANdisco Fusion) for customers requiring a hybrid cloud environment solution.

Although WANdisco has previously supported Hadoop to offer a SQL solution on private clouds, this is the first time the company has been in a position to also support relational databases for hybrid set-ups.

IBM Db2 Big SQL, which has been jointly developed with WANdisco, takes IBM Big Replicate one step further, offering a SQL engine for Hadoop, with the added bonus of HDFS, RDBMS, NoSQL databases, object stores and WebHDFS source support.

"This co-engineered SQL solution with IBM is an exciting breakthrough for WANdisco as this is the first time that our technology has been applied to SQL data," David Richards, chief executive officer and chairman of WANdisco said.

"This launch also represents a significant advancement of our relationship with a key partner and the scope of our addressable market in IBM's channel. WANdisco's unique technology presents great opportunity to collaborate with partners to address novel data requirements that previously have not been possible to meet."

Benefits of IBM Db2 Big SQL include low latency, high security, SQL compatibility, and Enterprise Data Warehouse (EDW) and federation capabilities, giving data scientists and others with the responsibilities for processing data the tools to access data and scale their business, however many users need to access the information at once.

"Our close relationship with IBM was built upon further in 2018 with an increased royalty percentage and substantial client contracts," Richards added. "We look forward to growing opportunities with IBM in the year ahead, leveraging our new co-engineered product to address as yet untapped data requirements."

Drupal has patched an SQL injection flaw that could potentially let hackers load malicious code onto sites running version 7 of the platform.

The Drupal Association wrote in its advisory: "A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests, this can lead to privilege escalation, arbitrary PHP execution, or other attacks.

"Although there are no known exploits in use at this time, Drupal 7 sites are exposed to this vulnerability until they are updated."

It went on to say that unlike other vulnerabilities that could be fixed by plugging holes, this can only be patched by installing the latest version of Drupal - version 7.32 - to guard against possible attacks.

The flaw was discovered in an API that was developed to prevent such attacks happening against the open source content management system, but, as the Drupal Association admits, something went wrong and instead of sanitising the database requests against malicious code, it allowed requests to be made.

The vulnerability has been present since November 2013, but it wasn't until an independent security researcher discovered the problem and alerted Drupal that it was patched.

The company said it was advised of the vulnerability in the third week of September of 2014, but decided to wait until it had a security update scheduled before rolling out the patch.

Since Drupal issued the original alert, it updated the post, saying "There are now proof of concept (POC) instructions in the wild that demonstrate how to exploit this. While we do not have reports of actual usage, the nature of this vulnerability is such that the attack can be difficult to detect."

SQL injection and DDoS attacks are still the main ways in which hackers aim to attack websites.

Nearly one fifth of discussion volume (19 per cent) in a hacker forum comprising of 250,000 members, was dedicated to discussing SQL and DDOS attacks, according to data security firm, Imperva.

SQL injections are currently the top priority for hackers, as security teams and businesses have failed to take precautions to protect themselves, the firm in its Monitoring Hacker Forums report.

Gleaming sensitive information through popular social media networks and the practice of E-whoring are also on the rise.

Facebook and Twitter are the most discussed media platforms in hacker forums taking up 39 per cent and 37 per cent of the discussion time, respectively.

"Facebook and Twitter are on top of that list and with some presence of Myspace and Google + and LinkedIn," Tal Be'ery, web researcher for Imperva, told IT Pro.

"But Facebook and Twitter are at the top because are the most popular [and] therefore the most interesting data can be found there."

E-whoring, the practice of selling pornographic content, is becoming more popular avenue for hackers who exploit men and women. Hackers typically pretend to be women and tempt victims into paying money for 'E-whoring packages' with the promise of pictures and videos.

Hackers aims to attain street cred' in forums by giving aspiring students tips and tricks. As they start to learn more, students are given topic forum-specific codes so that the experienced hacker does not give out vital information about what they know or who they are.

Be'ery added that through the private network within forums, hackers use private messaging, giving certain people authentication privileges or using instant messaging since creating accounts is easily accessible.

Businesses should use CAPTCHA authentication and monitor browser traffic to make sure they are protected from attacks, he added.

In a somewhat ironic hack, MySQL.com has been compromised as a result of an SQL injection attack, leading to usernames and password hashes being published online.

The exploited flaws did not lie within MySQL business database management software, but in the implementation of the Oracle-owned website.

The hackers posted a host of usernames and password hashes some of which have reportedly been decrypted already onto Pastebin.com.

Hackers Ne0h and TinKode claimed responsibility for the compromises. The latter said they were behind an SQL injection attack on the Royal Navy website last year.

A number of the employee passwords leaked by the MySQL.com hackers appeared to be fairly weak, according to Chester Wisniewski, senior security advisor at Sophos Canada.

"Most embarrassingly, the director of product management's WordPress password was set to a four digit number... his ATM PIN perhaps?" Wisniewski said in a blog.

"The irony is that they weren't compromised by means of their ridiculously simple passwords, but rather flaws in the implementation of their site."

MySQL owner Sun Microsystems now an Oracle subsidiary was also targeted by the two hackers, as tables and emails were dumped on Pastebin, but no passwords.

"It was noted on Twitter that MySQL.com is also subject to an XSS (cross-site scripting) vulnerability that was reported in January 2011 and has not been remedied," Wisniewski added.

Promise has launched a two-bay network attached storage (NAS) device that costs just 145 ex VAT.

The SmartStor NS2600 has two hard disk bays so supports both RAID 0 and RAID 1. It is then up to the user if it is deployed for either maximum performance or greater data redundancy.

Promise claimed the NS2600 used just 7W of power when it sleep mode, so it's environmentally friendly too.

As well as several consumer-oriented features, such as a UPnP media server and a download manager, the NS2600 also has several business-focused features. These included the ability to act as a print server, potentially saving the cost of a dedicated network printer, and the ability to act as a repository for IP security camera footage.

It supports Microsoft Active Directory and can even be used as a web or SQL server which will be attractive to smaller businesses with tight IT budgets.

We suspect the NS2600 is the two-bay version the larger and more expensive NS4600, which was favourably reviewed by our colleagues at Expert Reviews.

However, Promise isn't as well known as rival NAS manufacturers Synology and Thecus, who make NAS devices with the benefit of broader support amongst third party plug-in developers. It may, therefore, struggle to attract customers not motivated purely by price.

The SmartStore NS2600 will be available shortly and is backed by a two-year limited warranty.

The number of IT jobs being advertised fell by 24 per cent in the last quarter of 2008, as the struggling economy took its toll.

According to numbers from Salary Services Limited (SSL), IT recruitment fell from 129,672 jobs in the third quarter of last year, to 98,173 in the last quarter. A post on its site claimed this was the worst decline in jobs since 2001 and could soon be as bad as 1991.

The number of jobs advertised in London since the start of 2008 has fallen 45 per cent much of that in the past six months.

As demand falls, salaries are also being hit, said George Molyneaux, research director for SSL, in a statement. "Needless to say this reduction in demand is starting to feed through to pay levels with advertised salaries remaining at the same level as last year. The first time this has happened since 1992," he said.

Still, many skills are still in demand. While SQL skills fell 12.5 per cent on-quarter, it was still the most advertised, across both the contract and permanent markets.

The Royal College of Physicians (RCP) has upgraded its IT security with a database intrusion detection and prevention system (IDS and IPS) appliance.

The UK-based medical professional organisation has deployed the activity monitoring tool, Secerno.SQL to protect the confidential data held on its 22,000 fellows and members worldwide in its Structured Query Language (SQL) databases.

Christopher Venning, RCP IT and network support manager said: "Over the years, we have invested heavily in protecting our network perimeter and locking down our website. However, the threat landscape is continually evolving and hacker attacks are becoming highly targeted, cleverly written to circumvent network defences."

Venning said the College wanted to upgrade the protection of its highly confidential members' information against SQL injection attack.

"A data security breach would have disastrous ramifications for us, damaging not only our reputation, but also the security of our members, to whom we have a duty of care," he added.

The implementation included a security audit of all the RCP's legacy applications and the identification of database storage areas, interactivity between databases, and data access policies across the organisation.

The audit findings were used to configure the monitoring tool and refine data access policies.

"Despite being a relatively new implementation, the results are clearly visible," Venning said. "We have a better understanding of how, why and by whom our databases are being used. And more importantly, we are in a position to continually make security improvements."

The National Health Service's official website, NHS.uk, was one of a thousand websites compromised by a massive web attack this month, according to Finjan.

In its latest blog, Finjan said that the attack was caused by a trojan toolkit called Asprox', which has been around for a while, gaining popularity during 2007.

The toolkit works by first searching Google for webpages with the file extension '.asp'. Once found, it launches an SQL injection attack, which appends a reference to the malware file using the iframe (SCRIPT) tag. The most serious attack of recent times was back in April when IT PRO reported on a SQL attack which affected half a million websites.

Each of the 1,000 or so different compromised websites included a reference to malware which was in turn served by 160 other internet domains.

Finjan chief technical officer Yuval Ben-Itzhak believed that as the malware serving domains were increasing, much more was to come from Asprox.

"Among the compromised websites we found were those of respectable organisations, governmental institutes, health care organisations as well as high-ranked websites," he said.

Another website said to be affected were atdmt.com, a digital media company which Microsoft are looking at acquiring. The official websites for the government of San Francisco and the University of California were also compromised.

PC makers flout XP end date

Dell and other manufacturers are telling Vista-phobic buyers to exercise their "downgrade rights" to keep the older Microsoft operating system.

No Microsoft decision yet on Yahoo bid

Microsoft has failed to reach a decision about its next step in its stand-off with Yahoo over its billion dollar takeover bid.

Microsoft denies fault for massive SQL attack

The company insists that there were no vulnerabilities specific to Windows which could have allowed a massive database attack affecting over half a million web pages.

IT pros get political ahead of London's mayoral election

Research into the political leanings of leading UK bloggers and internet forum posters shows an opinion poll-defying sub-trend among the net-savvy.

HMRC staff fired for looking at sensitive data

Hundreds of staff at HM Revenue and Customs (HMRC) have been disciplined - and others fired - for accessing private or sensitive data without permission.

Robots butlers in ten years

Earlier this week, Intel showcased a set of innovations in its robotics research from its labs in Seattle and Pittsburgh, showing the current limitations - as well as the potential - of such technology.

Microsoft has denied that there is any vulnerability in its Internet Information Services (IIS) or SQL server after reports of a massive SQL injection infecting hundreds of thousands of web pages.

The automated attack was reported by F-Secure to have infected more than half a million websites, including those of the United Nations and the UK government. These had been hacked and modified to download malware to visitor's computers, resulting in many being shut down.

Microsoft denied it was due to any new or unknown vulnerabilities in ISS or SQL. It also said the Security Advisory that was published on 17 April which flagged up vulnerability in Windows was unconnected to the incident.

"The attacks are facilitated by SQL injection and are not related to issues related to IIS 6.0, ASP, ASP.Net or Microsoft SQL technologies," said Bill Sisk, a communications manager at Microsoft's Security Response Centre on the IIS blog.

It was claimed that attackers created an automated attack which took advantage of SQL injection vulnerabilities in web pages which did not follow security best practices for web application development.

Microsoft said that even though the attacks targeted sites hosted on IIS web servers, the vulnerabilities could be found on any platform.

Data security provider Secerno claimed that this was the first database threat that was equal in size and scope with well-known PC and virus attacks.

"What is different about this threat is that it automates attacks that were previously done by hand. This capability has increased both the threat level and the possible number of sites infected significantly," said Steve Moyle, chief technology officer at Secerno.

"The attack works by exploiting weaknesses on the web site to gain access to the website and essentially take it over. Once in control of the database, the SQL injection takes every piece of data and adds a link with a malicious Java script."

He added: "When a web visitor goes to a page and clicks on a link with the infected Java script, his computer becomes infected."