SQL injection

What it is

When user input is concatenated into a SQL query, an attacker can change the query — to read data, modify it, or drop tables.

How attackers exploit it

A login form that does `WHERE email='${input}'` lets an attacker send `' OR '1'='1` and log in as anyone.

How to protect against it

• Use parameterized queries / prepared statements everywhere. Never concatenate input into SQL.
• Use an ORM but verify it parameterizes — don't drop to raw SQL with template strings.
• Apply least-privilege DB roles so the app account can't drop tables or read other schemas.
• Turn on a WAF (Cloudflare, AWS) as defense in depth.

• PortSwigger Web Academy — SQL injection
• OWASP SQL Injection Prevention