Short note on SQL Injection:

Attack where attacker injects malicious SQL via user input to alter query logic. Example: Input "' OR '1'='1" into login: SELECT * FROM users WHERE name='' OR '1'='1' -- bypasses authentication, returns all rows. Can lead to data leak, delete, privilege escalation.

Types: Error-based, Union-based, Blind,.

Prevention: Use prepared statements/parameterized queries (SELECT * FROM users WHERE name=?), input validation/sanitization, least privilege, WAF, avoid dynamic concatenation, use ORM.

Example parameterized in Java: PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE name=?"); ps.setString(1,input);