Node.js
/Intermediate
SQL Injection
Definition
A code injection technique that might destroy your database. It occurs when malicious SQL statements are inserted into entry fields for execution.
Explain Like I'm New
You have a login query: `SELECT * FROM users WHERE email = '` + req.body.email + `'`. A hacker types `' OR '1'='1` into the email field. The final query becomes `SELECT * FROM users WHERE email = '' OR '1'='1'`. Since 1 always equals 1, the database says 'True!' and logs the hacker into the first account in the database (usually the Admin).
Real World Example
The most famous web vulnerability in history. It can be used to bypass logins, steal entire databases, or completely DROP (delete) tables.
Common Use Cases
- •Securing relational databases (PostgreSQL/MySQL)
Interactive Example
const userInput = "admin@test.com' OR '1'='1"; // --- BAD (VULNERABLE) --- // String concatenation allows the input to alter the SQL logic. const badQuery = `SELECT * FROM users WHERE email = '${userInput}'`; console.log("DANGEROUS QUERY:"); console.log(badQuery); // --- GOOD (PREPARED STATEMENT) --- // The SQL logic is locked. The '?' acts as a placeholder. const goodQuery = `SELECT * FROM users WHERE email = ?`; const values = [userInput]; // The database engine receives the raw string, but knows it's strictly data, not logic. // db.execute(goodQuery, values); console.log("\nSAFE QUERY:"); console.log(goodQuery, "<-- Executed safely with data:", values);
Interview Questions
basic
- What causes SQL Injection?
intermediate
- How do you completely prevent SQL Injection?