Software Engineering · Security
An attack where unsanitized user input gets interpreted as SQL, letting an attacker read, modify, or delete data they shouldn't touch.
Example: A login form that builds a query by string-concatenating the username — entering `' OR 1=1 --` bypasses the password check.
In practice: Parameterized queries (prepared statements) eliminate the risk entirely — if you're ever building a query by string concatenation, stop.