Answer
SQL injection manipulates queries using malicious input. Prevent using prepared statements with bound parameters.
Quick Answer
SQL injection: attacker adds SQL code in user input that gets executed by the database. Prevention: always use prepared statements (parameterized queries): $stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?"); $stmt->execute([$email]). Never concatenate user input into SQL strings. Also: validate/sanitize input, use least-privilege DB accounts, and escape output properly.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ