Security
What is SQL Injection?
An attack where untrusted input is concatenated into SQL queries, letting attackers read, modify, or delete database contents.
Definition
SQL injection happens when user input is spliced directly into a query string: given "SELECT * FROM users WHERE name = '" + input + "'", an attacker submitting ' OR '1'='1 rewrites the query's logic, and variants can dump tables, bypass logins, or drop data. It has sat in the OWASP Top 10 for two decades and still breaches production systems. The complete fix is parameterized queries (prepared statements), which send SQL and data separately so input can never become syntax — ORMs like Prisma and Hibernate do this by default. Least-privilege database accounts and WAFs add defense in depth; escaping alone is fragile.