What is SQL Injection?
SQL injection is an attack where untrusted input is run as part of a database query, letting an attacker read or change data they should not reach.
SQL Injection explained
It happens when an application builds a query by pasting user input into the text. A crafted value can change the meaning of the query. The standard defences are parameterised queries, strict validation and giving the application a database account with only the permissions it needs.
Tools that generate SQL from questions, including AI tools, need the same care: queries should run with a read-only account, and anything that is not a plain read should be rejected.
Example
A login form that inserts the typed username straight into a query string can be tricked by a username that contains SQL.