SQL Injection

SQL injection is an attack that inserts malicious SQL code into input fields that are incorporated into database queries without proper sanitization. Successful attacks can read, modify, or delete database records, bypass authentication, execute operating system commands, or exfiltrate entire database contents.

It remains one of the most prevalent and damaging vulnerabilities, entirely preventable through parameterized queries and ORMs.