SQL injection, explained with one query
Why concatenating input into SQL breaks, and why parameters fix it for good.
1 min read
On this page
SQL injection happens when user input becomes part of a query's code instead of its data.
The vulnerable pattern
query = "SELECT * FROM users WHERE name = '" + name + "'" # never do thisThe fix: parameters
cursor.execute("SELECT * FROM users WHERE name = %s", (name,))The driver sends the value separately, so it can never change the query's structure.
Updated 5 November 2026
Keep reading
Digital forensics
Reading auth.log in five minutes
The four fields that matter in every SSH line, and the one command that finds password guessing.
1 min read