SQL injection is a malicious technique that is meant to compromise or destroy databases. It is one of the most common web-hacking techniques.
SQL injection is performed by placing malicious code in SQL statements via an input.
The following example is a code snippet that will retrieve a user from a database based on an
passedInAccountId = getRequestString("AccountId"); sql = "select * from Accounts where AccountId = " + passedInAccountId;
SQL injection can be used to compromise this code by injecting a
1=1; statement for
https://www.foo.com/get-user?AccountId="105 OR 1=1;"
1=1 will always evaluate to
TRUE. This will cause the executed code to output all of the Accounts table.