SQL Injection

Introduction

SQL Injection happens when user input is concatenated into SQL strings — letting attackers run their own queries. It is the most damaging web vulnerability of all time and 100% preventable.

Understanding the topic

Core concepts to understand:

• Caused by string-concat user input into SQL.
• Prevented by parameterized queries / prepared statements.
• ORMs use parameters by default — safe if you don't bypass them.
• Never trust input — even from internal services.
• Validate, but don't rely on validation alone.

Syntax reference

Visual workflow / architecture:

Vulnerable:
SELECT * FROM users WHERE name = '${name}';

input: ' OR 1=1 --
SQL:   SELECT * FROM users WHERE name = '' OR 1=1 --';

Safe (parameterized):
SELECT * FROM users WHERE name = $1;
binds: [name]

Real-world use

TalkTalk, Equifax and Sony all suffered massive breaches via SQL injection. Modern frameworks make it easy to avoid — yet it still appears in the OWASP Top 10.

Best practices

• Always parameterize. Never concat strings.
• Use ORMs / query builders correctly.
• Apply least privilege on DB users.

Hands-on exercise

Interview preparation — practice these questions:

• Q1. How does SQL injection work?
• Q2. How do parameterized queries prevent it?
• Q3. Are ORMs safe by default?
• Q4. Real-world breaches caused by SQLi.
• Q5. Defense-in-depth strategies.