Glossary · Phase 7 · Software engineering
SQL injection
An attack where text pasted into a database query changes the query itself. Placeholders prevent it.
The attacker's quote mark ended the string early and added
OR '1'='1', which is always true. That's SQL injection, one of the most damaging and common security bugs ever found. With a placeholder (?in SQLite,%sin many Postgres drivers), the value travels separately from the SQL. The database never treats it as code, whatever characters it contains.
Try it now
SQL runs in this order, not the order you write it, which explains many confusing errors.
Learn it properly
Databases and SQL · Store, query and join data with the language every database speaks. About 40 minutes.
Other terms from the same lesson
- database transaction: A group of database changes that all happen together or not at all.
- foreign key: A column holding another table's primary key, which links the two rows, like an order's customer_id.
- primary key: A column that uniquely identifies each row of a table, such as an id.
- SQL: The language almost every database understands, for storing, finding, combining and summarizing data in tables.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.