MySQL Injection

SQL injection is an attack where an attacker inserts a malicious SQL snippet through an application input, such as a login column, to manipulate a server query. A classic example is to add 'OR' = 1' so that the WHERE condition is always true and all the data leaks. The most effective way to prevent this is to use a prepared statement with a binding parameter, rather than compiling a query with string merging.