[01] DEFINITION
Query manipulation
SQL Injection can occur when an application unsafely combines user input with an SQL command.
// PHP VULNERABILITY SERIES_01
SQL INJECTION
A small input can change database logic when it is added to an SQL query unsafely. Learn what SQL Injection (SQLi) is, where PHP applications are at risk, and how to defend against it.
START LEARNING ↓root@security-lab:~
$ scan --topic SQLi
Loading vulnerability overview...
[OK] Input handling checked
[WARN] Unsafe query pattern found
[FIX] Use prepared statements
$ status: DEFENSE_READY
01 / THE BASICS
What is SQL Injection?
[02] ROOT CAUSE
Trusting raw input
Adding input directly to a query can blur the boundary between database commands and data.
[03] IMPACT
Data at risk
Depending on the situation, SQLi can lead to unauthorized data access, record changes, or data loss.
02 / PHP CODE REVIEW
Vulnerable PHP vs. Secure PHP
// Avoid: input query mein concatenate ho raha hai
$userId = $_GET['id'] ?? '';
$sql = "SELECT * FROM users WHERE id = '$userId'";
// Raw input SQL syntax ko badal sakta hai
// Real app mein is pattern ka use na karein
// PDO prepared statement ka example
$userId = filter_input(
INPUT_GET, 'id', FILTER_VALIDATE_INT
);
if ($userId !== false &&
$userId !== null) {
$stmt = $pdo->prepare(
'SELECT * FROM users WHERE id = :id'
);
$stmt->execute(['id' => $userId]);
$user = $stmt->fetch();
}
WHY THIS HELPS → Prepared statements SQL code ko user ke data se alag rakhte hain. Input validation bhi zaroori hai; sirf validation prepared statements ka replacement nahi hai.
03 / INTERACTIVE CONCEPT
A safe input demo
This is a local, simulated example only. It does not send requests to any website or database.
Login form simulation
READY_
Enter a username and run the demo. The input will be treated as text; no real login attempt will be made.
04 / DEFENSE CHECKLIST
Secure your PHP website
✓ Prepared statementsUse parameterized queries with PDO or MySQLi.
✓ Validate inputCheck the expected type, length, and format.
✓ Least privilegeGive database users only the permissions they need.
✓ Safe errorsDo not expose database errors or secrets in production.
✓ Update dependenciesUse a supported PHP version and maintained libraries.
✓ Test with permissionTest security only on your own website or an authorized lab.
REMEMBER: SQLi is not caused by PHP itself—the core problem is unsafe query construction. Prepared statements are one of the most important defenses.