SQL Injection

SQL injection happens when untrusted data is allowed to change the structure of a query instead of being treated as data.

Documented since the late 1990s, and still the vector in some of the largest breaches on record. Parameterized queries keep data and structure separate, which removes the class.

Calling the fix "sanitization" is part of why it persists. It suggests input can be cleaned and made safe, which sends teams to escaping functions instead of separating data from code.

Discussion prompts

• Does your codebase use parameterized queries consistently — or are there legacy paths that don't?
• What would it take to audit your entire codebase for SQL injection risk — and have you done it?
• What organizational conditions allow SQL injection to keep appearing in modern applications?