SQL Antipatterns, Volume 1

Antipattern: Execute Unverified Input As Code

SQL injection happens when you interpolate some content into an SQL query string and the content modifies the syntax of your query in ways you didn’t intend. In the classic example of SQL injection, the value you interpolate into your string finishes the SQL statement and executes a second complete statement. For instance, if the value of bugid is 1234; DELETE FROM Bugs, the resulting SQL shown earlier would look like this:

SQL-Injection/anti/delete.sql

​SELECT​ * ​FROM​ Bugs ​WHERE​ bug_id = 1234; ​DELETE​ ​FROM​ Bugs

This type of SQL injection can be spectacular (cartoon by Randall Munroe,^[31] used with permission).

Usually these flaws are more subtle, but still dangerous. ...