What it is

SQLi happens when user input is concatenated into a SQL query instead of being passed as a bound parameter. The injected syntax changes the query's logic, letting an attacker read or modify arbitrary data and, on some engines, execute commands.

How to test for it

Probe each input with a single quote and SQL meta-characters and watch for errors or behavioural changes. Confirm with boolean and time-based payloads for blind cases, then enumerate the database with UNION-based extraction where the result set is reflected.

How to prevent it

Use parameterised queries / prepared statements everywhere — never string concatenation. Apply least-privilege database accounts, validate input types, and use an ORM correctly so raw query building never reaches user input.