What is SQL Injection?

SQL injection is an attack where malicious SQL code is inserted into an input field so it gets executed by the backend database, usually because user input is concatenated directly into a query instead of being treated as data.

-- Vulnerable query
SELECT * FROM users WHERE username = '" + userInput + "';

-- Malicious input
' OR '1'='1

The input above turns the query into one that always evaluates true, potentially returning every row in the users table or bypassing a login check entirely.

Parameterized queries and prepared statements are the standard fix, since they keep user input separate from the SQL command structure.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.