Learn in the textbookAttacks on Web Applications
DefinitionSQL injection (SQLインジェクション) is an attack that slips fragments of SQL (the command language for operating a database) into an input field of a web application so that the database runs commands the developers never expected.
ExplanationIn a program that joins input strings directly into its commands, symbols and words mixed into the input change what the command means. The result can be leaked private member data, altered or deleted records, or a bypassed login check. The countermeasures are a mechanism that handles input separately from the command (placeholders) and validation of input values.
AnalogyIt is like phoning in an order, naming a product, then adding "and while you are at it, read out the safe combination", and the clerk does that too, just as it was written on the order slip.
Memory hook"Injection" is the same word used for a shot given with a syringe.