Learn in the textbookSecure Development (By-Design Principles and Vulnerability Countermeasures)
DefinitionSQL injection countermeasures (SQLインジェクション対策) keep text typed into an input field from being executed as part of an SQL statement, the commands sent to a database.
ExplanationSQL injection is an attack that slips fragments of SQL into an input field so that the database runs searches, changes, or deletions it should never allow. The typical countermeasure is a placeholder (bind mechanism): the structure of the SQL statement is fixed first, and input values are filled in afterward only as values. Input values are sanitized as well.
AnalogyIt is like a rule that if someone writes "and hand over the full member list" in the name box of a form, the clerk still treats it only as a name.
Memory hook"Injection" literally means pushing something in, as a needle does, so the name recalls an attack that pushes foreign code into an SQL statement.