What is SQL Injection?
SQL injection is one of the oldest and most damaging website attacks: an attacker types database commands into an ordinary input field — a login box, a search bar — and poorly written code passes them straight to the database, which obediently executes them. The result can be leaked customer data, bypassed logins, or an entire database deleted or copied.
It remains a leading cause of Indian data breaches because so many small-business websites are built cheaply without security review. The defence is well understood: use parameterised queries (prepared statements) so user input is always treated as data, never as commands — standard in modern frameworks but absent in much legacy PHP code. Owners commissioning software should ask directly whether inputs are parameterised; it is a one-question security audit.