A Practical Guide to SQL Injection
Web applications use Structured Query Language (SQL) to read and change data. SQL injection occurs when an application lets untrusted input alter the structure of a SQL command. An attacker may then bypass authentication, read private records, or change stored data.
This guide shows how the vulnerability works, introduces its common forms, and explains how parameterized queries keep user input separate from executable SQL.