SQL Injection

SQL Injection is a web application attack where an attacker inserts malicious database commands into input fields (login forms, search boxes, URL parameters) to manipulate the application's database. If successful, the attacker can read, modify, or delete data, bypass authentication, or even take control of the database server.

SQL Injection has been one of the most common and dangerous web application vulnerabilities for decades. It's preventable through proper coding practices — primarily using parameterized queries instead of building SQL statements from user input.