SQL Injection
SQL injection happens when untrusted text becomes part of SQL instructions. The fix is to keep values separate from the statement structure through the database driver's parameter binding, not to guess which dangerous characters to remove.
Understand the idea
The statement below is a parameterised query shape. A driver binds the email value to the placeholder; the email is not pasted into the SQL string. In PHP PDO, call prepare with this SQL and execute with the value array. A bound value cannot stand in for a table name or an ORDER BY direction, so dynamic identifiers need an explicit allowlist.
Where to try it
Use PHP PDO for this example. It is shown for reading and local practice; the SQLite browser editor does not run this dialect or supply application-driver parameters. Follow the setup and explanation below in a disposable local environment.
SQLite sample data · MySQL / MariaDB sample data · See the sample tables
A worked example
SELECT customer_id, name
FROM customers
WHERE email = ?;
Read the result
This is a driver example, not a standalone playground query. With mira@example.test bound as the value, the application retrieves Mira. Quotes inside a bound value remain data rather than changing the query structure.
Try one change
Write an allowlist containing the only permitted sort columns. Explain why a sort column cannot be safely supplied as a value placeholder.