1
SQLAdvanced#aggregates
SQLIntermediate#security
What is SQL injection and how do you prevent it?
An attack where user input is concatenated into SQL and changes its meaning. Prevent it with parameterised queries or prepared statements, least-privilege database users and input validation — never string concatenation.
Example
-- vulnerable "SELECT * FROM users WHERE email = '" + input + "'" -- safe PREPARE s FROM 'SELECT * FROM users WHERE email = ?';