Ravi Sir's Cyber Security Cards › Revision Cards
A03 Injection: SQL Injection
A03 Injection: SQL Injection SQL injection : an attacker puts database commands into an input box. Input 1' OR '1'='1 makes the query always true and returns every row. Worse: 1'; DROP TABLE users;-- can delete a table. The fix is prepared statements , so input is always treated as data, never as SQ
Read card text
What this card says
What it is
SQL injection: an attacker puts database commands into an input box.
Example
Input 1' OR '1'='1 makes the query always true and returns every row.
Worse: 1'; DROP TABLE users;-- can delete a table.
Why it matters for security
The fix is prepared statements, so input is always treated as data, never as SQL.
Also use a least-privilege database user.
Learn more in the lesson: 29.2 A03 Injection: SQL Injection