SQL Injection and Prevention

What is SQL Injection?

How it Happens

If a login query is built by joining strings: a user typing ' OR '1'='1 can bypass the password check. The danger is mixing user input directly into SQL.

The Fix: Prepared Statements

// PHP PDO - safe
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$email]);

Summary

• SQL injection runs attacker SQL via input fields.
• Prevent it with prepared statements / parameterized queries — never glue user input into SQL.

SQL Injection क्या है?

यह कैसे होता है

अगर login query strings जोड़कर बनती है: user ' OR '1'='1 type करके password check bypass कर सकता है। खतरा user input को सीधे SQL में मिलाना है।

Fix: Prepared Statements

// PHP PDO - safe
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$email]);

सारांश

• SQL injection input fields से attacker SQL चलाता है।
• Prepared statements / parameterized queries से रोकें — user input को SQL में कभी न जोड़ें।