One of the oldest web vulnerabilities, and still one of the most common.
Direct answer
SQL injection occurs when an application builds a query by pasting user input into the SQL text, letting an attacker change the query. Prevent it with parameterised queries (prepared statements), least-privilege database accounts and input validation.
A vulnerable pattern
// Dangerous: never do this
const sql = "SELECT * FROM users WHERE email = '" + email + "'";
If email is ' OR '1'='1, the condition becomes always true.
The fix
// Safe: values are sent separately from the SQL
const result = await db.query(
"SELECT * FROM users WHERE email = $1",
[email]
);
Other protections
- Give the app's database user only the permissions it needs.
- Validate input types and lengths.
- Hide detailed database errors from users.
- Keep software updated.
Where Teyro fits
Teyro's SQL and Databases for Beginners course turns this into short lessons you can play in a few minutes a day. It has 50 lessons, and you can start free.
The bottom line
Never concatenate user input into SQL. Use parameters.
