SQL injection explained
How SQL injection works and how to prevent it for good: a vulnerable login and search with real payloads, what attackers can do, parameterised queries in Java, Python and Node.js, ORMs and their raw-query traps, dynamic identifiers, least privilege, and testing.
CodexBash, , 5 min read
SQL injection happens when an application builds a database query by gluing user input into the SQL text, and an attacker supplies input that changes the query's meaning. It is one of the oldest web vulnerabilities, and it still causes major breaches, because it is easy to introduce in a hurry and devastating when exploited: attackers can bypass logins, read entire databases, modify data and sometimes take over the server. The good news is that prevention is simple and complete. This article shows exactly how the attack works, then how to make it impossible.
Sign in to read the rest
The whole 5 minute article is free with an account, along with every problem, lesson and tutorial. No card.