SQL Injection

SQL injection is what happens when user input is concatenated into a query as raw text — the attacker can change the meaning of the SQL the app intended to run.

The vulnerable pattern

// $_POST['email'] is attacker-controlled
$sql = "SELECT * FROM users WHERE email = '" . $_POST['email'] . "'";
mysqli_query($conn, $sql);

If email is ' OR 1=1 --, the resulting SQL becomes:

SELECT * FROM users WHERE email = '' OR 1=1 -- '

Now it returns every row. With UNION the attacker can leak other tables; with ;DROP they can destroy them.

The fix — parameterised queries

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$_POST['email']]);

The driver sends the SQL and the parameter separately. The DB never tries to parse the parameter as SQL — injection becomes impossible.

Same idea, other languages

Defence in depth

• Use the app's ORM or query builder — most bind automatically.
• Give the app's DB user the least privileges it needs (no DROP, no GRANT).
• Use a WAF / IDS for anomaly detection.
• Treat all input as hostile, including from authenticated users.

Example

-- Use parameters, never concatenate user input:
SELECT * FROM users
WHERE email = ? AND password_hash = ?;

Exercise

Test yourself