SQL Injection

ELI5 — The Vibe Check

SQL injection is when a hacker types SQL code into a text field instead of normal text, and your stupid database runs it. Like if someone's name in a form was ' OR 1=1; DROP TABLE users; -- — and your code just runs that. Boom, your user table is gone. Use parameterized queries. Always.

Real Talk

SQL injection is an attack where malicious SQL is inserted into input fields that are concatenated into database queries. Attackers can bypass authentication, read sensitive data, or destroy databases. Prevention requires parameterized queries (prepared statements) or an ORM that handles escaping.

Show Me The Code

// ❌ NEVER concatenate user input into SQL
const query = `SELECT * FROM users WHERE email = '${email}'`;

// ✅ Use parameterized queries
const query = 'SELECT * FROM users WHERE email = $1';
const result = await db.query(query, [email]);

// ✅ Or use an ORM (Prisma, Drizzle, etc.)
const user = await prisma.users.findFirst({ where: { email } });

When You'll Hear This

"The login form is vulnerable to SQL injection." / "Always use parameterized queries to prevent SQL injection."