What is SQL injection and how do you prevent it?
Model answer
An attacker puts SQL into an input that is concatenated into a query. Prevent it with parameterised queries (prepared statements) so input is always treated as data, use least-privilege database accounts, validate input, and never build SQL by string concatenation. ORMs help but raw queries inside them can still be unsafe.
Learn this topic
SELECT, FROM and WHERE: Your First Queries in the course SQL for Beginners: Learn Databases Step by Step.
Sign in to add your own answer.