What is SQL injection?
When an app pastes user input straight into a database query, so the input runs as part of the query.
One of the oldest and most common ways websites get hacked starts with a simple form field. It's called SQL injection.
What it is
SQL injection happens when an app pastes user input straight into a database query, so the input runs as part of the query.
How it works
Say the app builds a query by pasting in whatever name you type. An attacker types a quote mark, then a bit of SQL, like OR 1=1. Now the query means something new: return every row, or even delete a table. The fix is parameterized queries: the query and the input travel separately, so input is always data, never code.
Why it matters
Injection is still on the top ten list of web security risks. Modern libraries protect you, unless you paste strings into queries.
