Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

SQL injection

An attack where user input is pasted into a query and changes what the query does.

SQL injection happens when untrusted text is concatenated into SQL; binding parameters prevents it.

Loading interactive…

Examples

  • Pasting x' OR '1'='1 into WHERE name = '{input}' makes the query match every row; sqlx 0.9 refuses a format! string as SQL unless wrapped in AssertSqlSafe.

See also

prepared statement query builder software supply chain
Read the full section →