SQL Injection
also: SQLi
A classic attack: unescaped user input is treated as SQL code, letting an attacker read or destroy your database.
SQL injection is a vulnerability where user input is concatenated into a SQL query so that crafted input changes the query’s meaning — letting an attacker read, modify, or delete data they should not, or bypass authentication. It is one of the oldest and most damaging web vulnerabilities.
Worked example: a login query built as …WHERE user = '{input}'… lets an attacker enter ' OR '1'='1 to make the condition always true and log in as anyone; worse payloads dump or drop tables. Gotcha: the fix is not hand-escaping (error-prone) but parameterized queries / prepared statements, which send the SQL and the data separately so input can never be parsed as code — never build SQL by string-concatenating user input, full stop.