BeCuriouzLearn something new every day
The 25-year-old bug that still leaks databases
💡 SQL injection happens when apps mix user input into database commands as text; parameterized queries defeat it by keeping the command and the input strictly separate.
In 1998 a hacker described a trick that still tops vulnerability lists today: SQL injection. It works because many apps build database commands by gluing your input directly into a text string. A login form might construct: SELECT FROM users WHERE name = ' + whatever you typed + '. If you type an ordinary name, fine. But type ' OR '1'='1 and the app cheerfully assembles a command that means "match every row"* — because the app can't tell where its instructions end and your data begins.
That blurred line is the whole problem. The database sees one string and dutifully executes all of it as code, even the part that was supposed to be data. Attackers use this to dump password tables, bypass logins, or delete records — no break-in required, just a cleverly punctuated text box.
The fix is elegant: parameterized queries (also called prepared statements). Instead of building one string, the app sends the command with a placeholder (?) and hands over your input separately. The database treats that input purely as a value to compare — never as instructions. This is why the security mantra is never trust user input and keep code and data separate.