SQL injection

Meaning

SQL injection is an attack in which input typed by a visitor changes the meaning of a database command. It happens when a program builds a query by joining text with user input, letting an attacker read, change or delete data. The PHP manual recommends binding all data through prepared statements and warns that binding covers values only; other dynamic parts, such as a sort direction, must be checked against a list of allowed values. Connect with a database account that has minimal privileges. See also: Prepared statement, PDO, and the guide PHP Security Basics: Validation, Prepared Statements and More.