Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

SQL injection

An attack where user input is pasted into SQL and changes what the query does.

SQL injection occurs when untrusted input is concatenated into SQL text; parameterized queries send values separately so they can't alter the command.

Examples

  • Building "SELECT * FROM Users WHERE Name = '" + name + "'" and receiving a name of x' OR '1'='1, which returns every user.

See also

parameterized query untrusted input command injection
Read the full section →