What is SQL injection and how do you prevent it? SQL Injection is a type of attack where an attacker inserts or manipulates malicious SQL code into a query, which can compromise the database. It usually happens when user input is improperly sanitized or validated. Prevention techniques: Use Prepared Statements/Parameterized Queries: This ensures that user input is treated

s data, not executable code.

• - Example in MySQL (using PDO in PHP)

$stmt = $pdo->prepare('SELECT * FROM users WHERE username =

:username AND password = :password');
$stmt->execute(['username' => $username, 'password' => $password]);

• ● Input Validation: Always validate user input by checking for expected data types,

lengths, and ranges.

• Escaping User Input: If parameters cannot be parameterized, make sure all user

input is properly escaped.

• Least Privilege Principle: Limit database user permissions to only those necessary

to perform their tasks.

• Web Application Firewalls (WAF): Use WAFs to detect and block SQL injection

ttacks.