What Is SQL Injection and How Do You Stop It?

How SQL injection actually works

An attacker inputs SQL code into a form field or URL parameter, and your application includes it in a database query without sanitization. The database executes the injected code as if it were a legitimate query. Classic example: ' OR '1'='1 as a username bypassing a login check entirely.

A real SQL injection example

Vulnerable: SELECT * FROM users WHERE email = '${email}' — if email = admin@example.com' DROP TABLE users; -- the database drops your entire users table. Parameterized: SELECT * FROM users WHERE email = ? with email as the parameter — the input is treated as data, never as SQL.

The complete fix: parameterized queries

Use prepared statements or parameterized queries in every database interaction. Every ORM (Prisma, TypeORM, Sequelize) does this by default when you use their query builders. The bug happens when developers bypass the ORM and write raw query strings with template literals.

Defense in depth beyond parameterization

Least-privilege database users (your app user shouldn't be able to DROP tables), Web Application Firewall rules to block injection payloads at the edge, input validation to reject clearly malicious patterns early, and error messages that don't leak database structure.