Understanding SQL injection

Are you self-employed or part of the company? Who can access your data in the company? Well, you suppose, only your manager can access data about colleagues from the same department and not about anyone from the whole company, right? It is, therefore, important to ensure that the system inputs cannot change the query without proper authorization and thus obtain completely different values and outputs. You probably wouldn’t want anyone to have access to your salary, available funds in your accounts, or other sensitive data. Consequently, it is necessary to secure and sanitize the inputs so that the user cannot influence the structure of the select statements or modify them to get principally different results.

The rule is simple: never rely on the user data, and always check it to ensure that suspicious code is not detected there.

SQL injection risk is a hazardous consequence of a developer prompting a user to get the value from the input. That...