Skip to content
Knowledge Hub/Article
Article

What Is SQL? SQL Commands, MySQL and SQL Server Explained

We explain how SQL works, the ISO/IEC 9075 standard, DDL, DML, DCL and TCL commands, its main dialects and how to defend against SQL injection.

Oğuzhan Gerçek··9 min read
What Is SQL? SQL Commands, MySQL and SQL Server Explained

Short answer: SQL (Structured Query Language) is the standard language for defining, querying and changing data in relational databases. It is declarative: you state which data you want, and the database decides how to get to it. The standard's formal name is ISO/IEC 9075, and its current edition is SQL:2023. MySQL, PostgreSQL, SQL Server, Oracle and SQLite all speak SQL, but each has its own dialect. The basic security rule is to keep user input out of query text and use parameterized queries instead.

What is SQL, and what does it stand for?

SQL is short for Structured Query Language. IBM's Db2 documentation describes it as a standardized language for defining and manipulating data in a relational database. In Oracle's definition, SQL is a declarative language: users specify the result they want, not how to derive it. It processes data in sets rather than row by row, and, according to Oracle's SQL reference, the optimizer determines the most efficient way to access the data.

According to IBM Research, E. F. Codd defined the relational model in "A Relational Model of Data for Large Shared Data Banks," published in Communications of the ACM on June 1, 1970. The paper's opening line also sums up the thinking behind SQL: future users of large data banks must be protected from having to know how the data is organized in the machine. Donald D. Chamberlin and Raymond F. Boyce introduced a language built on this model in a May 1974 paper, under the name SEQUEL (Structured English Query Language). According to Oracle's history of SQL, SEQUEL later became SQL.

The SQL standard: ISO/IEC 9075

According to Oracle's documentation, both ANSI and ISO/IEC have accepted SQL as the standard language for relational databases. The first ISO edition was published in June 1987 as ISO 9075:1987. The current edition is SQL:2023: ISO/IEC 9075-1:2023 defines the framework and ISO/IEC 9075-2:2023 the core of the language, and both are dated June 2023. Since June 2025, the ISO catalog has listed the standard as "to be revised."

Products do not follow the standard one to one. According to PostgreSQL's conformance documentation, the project conforms to at least 170 of the 177 mandatory features required for full Core conformance. That is why a query that runs on one system often needs changes on another.

Core concepts: tables, keys, indexes and transactions

According to the PostgreSQL tutorial, a relational database stores data in tables: each table is a named collection of rows, every row has the same set of named columns, and each column has a specific data type. SQL does not guarantee the order of rows; if you need an order, you ask for it with ORDER BY. The other core concepts, as defined in the PostgreSQL glossary:

  • Primary key: One or more columns that uniquely identify a row and cannot be null; a table can have only one.
  • Foreign key: A constraint requiring the value in a column to identify a row in another table.
  • JOIN: An operation that combines data from multiple tables in a single query.
  • Index: A structure that provides fast access to rows. According to the documentation, it adds overhead to data manipulation, so indexes that are seldom used should be removed.
  • Transaction: A group of commands that either all take effect or none do. In PostgreSQL, BEGIN opens one, COMMIT makes it permanent and ROLLBACK cancels it.

We cover the ACID guarantees of transactions in our DBMS article, and our glossary has a short definition of a database. The definition below creates two tables with their keys:

CREATE TABLE customer (
  id    integer PRIMARY KEY,
  name  text NOT NULL
);
CREATE TABLE orders (
  id           integer PRIMARY KEY,
  customer_id  integer NOT NULL REFERENCES customer (id),
  order_date   date NOT NULL,
  amount       numeric(12,2) NOT NULL
);

SQL commands: DDL, DML, DCL and TCL

SQL statements are usually grouped into four categories by function. The boundaries are not fixed: IBM notes that the DDL, DML and DCL labels are informal, while Oracle counts GRANT and REVOKE as DDL.

  • DDL (Data Definition Language): Creates, changes and removes objects (CREATE, ALTER, DROP).
  • DML (Data Manipulation Language): Reads and changes data (SELECT, INSERT, UPDATE, DELETE, MERGE).
  • DCL (Data Control Language): Manages privileges (GRANT, REVOKE).
  • TCL (Transaction Control): Makes DML changes permanent or undoes them (COMMIT, ROLLBACK, SAVEPOINT); Oracle calls these "transaction control statements".

SQL queries: SELECT, WHERE and JOIN

The PostgreSQL query below joins orders placed since the start of 2026 with customer names, sorts them by amount and returns the first ten rows:

SELECT c.name, o.order_date, o.amount
FROM orders AS o
JOIN customer AS c ON c.id = o.customer_id
WHERE o.order_date >= DATE '2026-01-01'
ORDER BY o.amount DESC
FETCH FIRST 10 ROWS ONLY;

The JOIN matches each order's customer_id with the customer's primary key, and orders without a match are left out. A LEFT JOIN instead returns every row of the left table; where the right table has no match, its columns come back as null.

The last line is a small example of dialect differences. FETCH FIRST is the standard syntax introduced in SQL:2008; PostgreSQL supports it and can do the same job with LIMIT, which MySQL also uses. In SQL Server, TOP or OFFSET and FETCH limit the row count, and Microsoft advises always using TOP with ORDER BY.

SQL dialects: MySQL, PostgreSQL, SQL Server, Oracle and SQLite

According to Oracle, flow-control statements such as if-then-else, loops and exception handling were initially not part of SQL and its standard; today they are in ISO/IEC 9075-4 (SQL/PSM). The main systems differ as follows:

  • MySQL: A relational DBMS developed by Oracle Corporation and distributed under the GPL, with a commercial license also available. Storage engines handle SQL operations for different table types; the default is InnoDB.
  • PostgreSQL: An open-source, object-relational DBMS whose procedural language, PL/pgSQL, is installed by default. See our PostgreSQL article.
  • Microsoft SQL Server: Microsoft's relational DBMS. In Microsoft's definition, T-SQL (Transact-SQL) is a proprietary extension of SQL that adds variables, error handling and transaction control.
  • Oracle Database: PL/SQL is, in Oracle's words, the Oracle procedural extension of SQL.
  • SQLite: An embedded SQL engine that runs without a separate server process and reads and writes ordinary disk files directly; its code is in the public domain.

SQL vs. DBMS vs. NoSQL

SQL is a language; MySQL, PostgreSQL and SQL Server are database management systems that run it. In AWS's comparison, the relational model normalizes data into tables and provides ACID properties. NoSQL databases use a variety of data models, such as key-value, document, graph and column, with flexible schemas; most relax some ACID properties and are typically partitionable. See our NoSQL article for more.

SQL security: SQL injection, least privilege and audit logs

According to OWASP, SQL injection arises in dynamic queries built by concatenating strings with user-supplied input. In the OWASP Top 10:2025, Injection fell from third to fifth place, and the list counts more than 14,000 CVEs for SQL injection. Three measures stand out:

  • Parameterized queries: OWASP's first defense is prepared statements. Values reach the database as separate parameters, so it always distinguishes code from data. Escaping all user input, by contrast, is "strongly discouraged."
  • Least privilege: Application accounts get no DBA or admin rights, and accounts that only read get read access only to the tables they need (IAM article).
  • Audit logs: In PostgreSQL, the log_statement setting logs CREATE, ALTER and DROP at the ddl level and adds INSERT, UPDATE and DELETE at the mod level; the default is none. In SQL Server, SQL Server Audit does this job (log article).

We cover the defense in front of the application in our WAF article.

SQL in the organization: who writes it, who runs it?

In the 2026 Stack Overflow survey, 58.4% of the 14,099 developers who answered the language question said they had done extensive development work in SQL over the past year, which puts SQL second behind JavaScript (62.0%). According to AWS, even with a managed database, query tuning is the customer's responsibility.

We cover the role that runs databases in our DBA article, backup types in our backup article and moving data into reporting systems in our ETL article. We handle day-to-day operations in our database platform and operations service, high-availability design in our database platform engineering service and migration from legacy systems in our application & database modernization service.

Frequently asked questions

What does SQL stand for? Structured Query Language. It is the standard language of relational databases, and its formal standard is ISO/IEC 9075.

What is MySQL? An open-source relational database management system developed by Oracle Corporation and licensed under the GPL. It stores data in tables and is queried with SQL.

What is SQL Server? Microsoft's relational database management system. Applications talk to it in T-SQL, Microsoft's extension of SQL.

What is the difference between SQL and MySQL? SQL is a language; MySQL is a database management system that runs it. Alongside the standard, MySQL also uses its own syntax, such as LIMIT.

What are the main SQL queries and commands? SELECT, which reads data, and INSERT, UPDATE and DELETE, which change it, belong to DML. CREATE (DDL), GRANT (DCL) and COMMIT (TCL) are examples from the other groups.

What is SQL injection? An attack in which user input inserted directly into query text lets an attacker change the query. OWASP's first recommendation is to use parameterized queries (prepared statements).

Sources