Glossary / Security & encryption

SQL injection

SQL injection tricks an application into running attacker-supplied database commands by hiding them inside ordinary input — a login field, a search box. A successful injection can read, alter, or delete an entire database. It has been the classic web vulnerability for two decades, and it is fully preventable: parameterized queries treat input strictly as data, never as commands.