Suggest an editImprove this articleRefine the answer for “What does "SQL injection" mean?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**SQL Injection** is a **vulnerability** where an attacker inserts **malicious SQL code** into a query to access or modify data; it happens when an application **doesn't filter user input**, letting an attacker "append" their own SQL statement right through a form or URL. **Key point:** for example, if a query is built by concatenating strings, `"SELECT * FROM users WHERE login = '" + user_input + "'"`, and the user enters `' OR '1'='1`, the query returns **every record** from the table; the defense is prepared statements, parameterized queries, and validating user input.Shown above the full answer for quick recall.Answer (EN)Image**SQL Injection** is a **vulnerability** where an attacker inserts **malicious SQL code** into a query to access or modify data. In simpler terms, when an application **doesn't filter user input**, an attacker can "append" their own SQL statement right through a form or URL. ### An example of dangerous code ```sql query = "SELECT * FROM users WHERE login = '" + user_input + "'"; ``` If a user enters: ```javascript ' OR '1'='1 ``` The query becomes: ```sql SELECT * FROM users WHERE login = '' OR '1'='1'; ``` which returns **every record** from the `users` table. SQL injections let an attacker: - obtain logins and passwords, - delete data (`DROP TABLE`), - change access rights. To defend against it, use: - **prepared statements**, - **parameterized queries**, - validation and escaping of user input. **Summary:** SQL injection is **tampering with a query through user input**, which can lead to a **database breach**.For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.