SQL injection inserts attacker-controlled SQL into queries—can read, modify, or delete entire databases.
Vulnerable pattern
# NEVER — string concatenation
query = "SELECT * FROM users WHERE email = '" + user_input + "'"Safe pattern
# Parameterized query
cursor.execute("SELECT * FROM users WHERE email = %s", (user_input,))ORM note
ORMs help but raw queries and order_by(user_column) can still be vulnerable—validate allow lists.
Important interview questions and answers
- Q: Parameterized queries?
A: DB treats input as data, not executable SQL. - Q: Blind SQLi?
A: Infer data from timing/error responses without direct output.
Self-check
- Why is string concat SQL dangerous?
- What is the fix?
Tip: Code review grep for string concat near SQL—ban in style guide.
Interview prep
- Fix SQLi?
Parameterized queries / prepared statements.