What is SQL injection and how do you prevent it?

Question

Accepted Answer

**SQL injection** is a vulnerability where an attacker inserts malicious SQL through user input — manipulating database queries to steal data, bypass authentication, or damage data. It's one of the most dangerous and classic web vulnerabilities, but is preventable with proper techniques.

## How SQL injection works

```text
When user input is concatenated directly into a SQL query, an attacker can INJECT SQL:
```

```js
// ❌ VULNERABLE — user input concatenated into the query
const query = `SELECT * FROM users WHERE email = '${userInput}'`;
// attacker enters:  ' OR '1'='1
// → SELECT * FROM users WHERE email = '' OR '1'='1'   → returns ALL users!
// or:  '; DROP TABLE users; --   → could delete the table
```

The attacker's input is treated as **SQL code** rather than data — letting them rewrite the query (bypass login, dump all data, delete tables).

## Prevention: parameterized queries (the main fix)

```js
// ✅ PARAMETERIZED / PREPARED statements — input is treated as DATA, never as code
const query = 'SELECT * FROM users WHERE email = ?';
db.execute(query, [userInput]);     // the value is safely bound, not concatenated
// → the database treats userInput as a literal value → injection impossible
```

**Parameterized queries (prepared statements)** separate SQL code from data — the input can never be interpreted as SQL. This is the primary, reliable defense.

## Additional defenses

```text
✓ PARAMETERIZED queries / prepared statements → the #1 fix (always use them)
✓ ORMs/query builders → use parameterization under the hood (but don't bypass with raw
  string concatenation)
✓ INPUT VALIDATION (defense in depth) — validate/sanitize, but NOT a substitute for
  parameterization
✓ LEAST PRIVILEGE DB accounts (limit damage); avoid exposing detailed DB errors
→ NEVER build queries by concatenating user input.
```

## Why it matters

Understanding SQL injection and how to prevent it is essential because it's **one of the most dangerous, classic, and common web vulnerabilities** (part of the OWASP injection category), yet entirely preventable, so it's must-know security knowledge for any developer working with databases.

Understanding **how it works** — that concatenating user input directly into SQL queries lets an attacker **inject SQL code** (their input treated as code rather than data), enabling them to bypass authentication (`' OR '1'='1`), dump all data, or even delete tables (`'; DROP TABLE`) — is necessary to recognize and avoid the vulnerability.

SQL injection can be catastrophic (full data breach, data destruction, authentication bypass), making it critically important.

Understanding the **prevention** is essential: **parameterized queries (prepared statements)** are the primary, reliable fix — they **separate SQL code from data** so user input is treated as a literal value that can never be interpreted as SQL, making injection impossible.

This is the #1 defense every developer must use.

Understanding the **additional defenses** — using ORMs/query builders (which parameterize, but not bypassing them with raw concatenation), input validation as defense-in-depth (but not a substitute for parameterization), least-privilege database accounts, and avoiding detailed error exposure — and the cardinal rule to **never concatenate user input into queries** reflects comprehensive prevention.

Since SQL injection is a dangerous, common, and classic vulnerability with severe consequences (data breach, data loss, auth bypass) that's entirely preventable with parameterized queries, and since understanding how it works and how to prevent it is essential for any developer working with databases, understanding SQL injection and its prevention is essential, must-know security knowledge — a fundamental vulnerability to understand and defend against, where the simple, reliable fix (parameterized queries) is critical knowledge that prevents one of the most damaging classes of attacks.