Databases · Junior · Question 48 of 75

What is SQL injection?

const sql = "SELECT * FROM users WHERE name = '" + name + "'";

1An error caused by a missing semicolon
2A way to insert many rows at once
✓Correct answer: An attack where user input changes the meaning of a query, e.g. ' OR '1'='1

Explanation

Never build SQL from strings. Use parameters (WHERE name = $1), which drivers send separately from the query text.

Further reading

Test yourself

Take the Databases · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.