1. SQL & NoSQL Injection

1. SQL & NoSQL Injection: SQL Injection is like inserting a magic skeleton key (like ' OR 1=1 --) into a database locker instead of a normal name, causing all the locks to shatte

SQL Injection is like inserting a magic skeleton key (like ' OR 1=1 --) into a database locker instead of a normal name, causing all the locks to shatter and all drawers to spill their contents.

2 Analogies: Explaining SQLi

The Waiter and Kitchen Analogy

The Magic Locked Box

2 Reasonings: Why Does It Happen?

Mixing Code and Data

Lack of Parameterization

2 LEGO Analogies: Building Safely

Vulnerability Simulation

Which SQL input can trick the database into logging in without a password?

admin' AND password='123

The quote in admin' OR '1'='1 breaks the query wrapper, and the appended OR '1'='1 evaluates to true, overriding the password validation check.

What should be used in code to completely prevent SQL Injection?

String Concatenation (+)