SQL Injection (SQLi) remains one of the most critical vulnerabilities in the OWASP Top 10 database. It occurs when untrusted user inputs are concatenated directly into backend database query strings rather than utilizing parameterized variables.

How a Vulnerable Query Works

Consider a standard backend authentication script that takes a username and password input directly from a web form and executes this query:

SELECT * FROM users WHERE username = 'USER_INPUT' AND password = 'PASSWORD_INPUT'

If an auditor inputs admin' OR '1'='1 into the username field, the SQL query logic is modified. The condition '1'='1' always evaluates to true, which bypasses the password verification entirely:

SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = '...'

The Defensive Shield: Prepared Statements

To defend web systems against SQLi, you must separate database queries from user data. Using Prepared Statements (parameterized queries) ensures the database engine treats input strictly as a parameter literal, never as executable code.

Here is a secure implementation using PHP PDO:

$stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE username = :user');
$stmt->execute(['user' => $userInput]);
$user = $stmt->fetch();