SQL Injection

Summary

An attack where malicious input is crafted to alter your SQL query's meaning — one of the oldest and still most damaging vulnerabilities, entirely preventable with parameterized queries.

• 1Deliberately build a vulnerable query, then fix it with parameterized queries/prepared statements.
• 2Confirm your ORM parameterizes queries by default — most do.
• 3Never string-concatenate user input directly into a raw SQL query, no exceptions.