Glossary

SQL Injection

SQL Injection is an attack where a malicious actor inserts arbitrary SQL code into a query through user input. If the application concatenates it without escaping, the attacker can read any data, modify or delete it, and in some databases execute OS commands.

Classic example

The query SELECT * FROM users WHERE email = '{$email}' with input ' OR 1=1 -- becomes WHERE email = '' OR 1=1 --' — returning every user.

Defence

Parameterised queries / Prepared Statements — the only reliable protection. Data and SQL code are always separate at the database protocol level
ORM — most modern ORMs use prepared statements automatically
Whitelist validation — verify the value is in an allowed list, not just escape it
Never concatenate user data directly into an SQL string, even after addslashes()