SQL Injection
What is it?
SQL injection is a code injection attack where malicious SQL statements are inserted into input fields, potentially allowing attackers to read, modify, or delete database data, bypass authentication, or even execute system commands. It exploits applications that concatenate user input directly into SQL queries instead of using parameterized queries or prepared statements.
Practical example
A vulnerable login form might build a query by concatenating strings: SELECT FROM users WHERE username equals the input AND password equals the input. An attacker entering a single quote followed by OR 1=1 as username makes the WHERE clause always true, bypassing authentication. The fix is using prepared statements where user input is passed as parameters, never concatenated into the query string.
Test your knowledge
How do you prevent SQL injection?