← Tech dictionaryLearn it properlySpring Boot tutorials — free, with diagrams, quizzes and a certificate
Security
What is SQL injection?
SQL injection is an attack where user input is inserted into a SQL query so that it changes the query’s meaning, letting attackers read or modify data. It is prevented by parameterised queries (prepared statements), never by string concatenation.
Example
Typing ' OR '1'='1 into a login form that builds SQL with string concatenation.