Grant Fritchey Profile picture
Grant Fritchey is a Microsoft Data Platform geek, an MVP and an AWS Community Builder. Grant works for Red Gate Software as a DevOps Advocate. Call: KC1KCE
May 29, 2019 13 tweets 6 min read
Right, #sqli or #sqlinjection.

Let's talk about it a little.

The concept is simple. Your code allows someone to place additional SQL commands in it. That "injected" code enables data access and/or system hacking (depending on the security in place). The problem, and the solution, has been well defined since 1998.

Simply put:
Parameterize the query
Escape the input
Have proper security in place
Use correct data types

In a nutshell. There's a ton more details, but that covers the basics.