What is SQL injection and how do I prevent it?
[top] A SQL injection attack lets malicious users alter SQL commands or execute arbitrary SQL commands. SQL injection attacks typically replace or add to queries that are already being legitimately executed as part of an application. When you use string concatenation to create a SQL statement with input values from an end user, it becomes possible to launch a SQL injection attack. For example, the following SQL statement might be used to verify a user’s password: sql = “select * from UserInfo where password='” + password + “‘”; A malicious user can use the following input to bypass the password check: password = “‘ or 1=1 –“; Even worse, the malicious user might use the command delimiter (; ) to add SQL commands to the user input, as in this example: ; DROP TABLE To help avoid SQL injection, use command parameters in SQL queries, which help validate user input. The single quotation marks will be represented in an alternate format to pass validation. This example will not cause SQL inj
