What is SQL injection?

SQL injection: untrusted input concatenated into a database query so the query’s meaning changes. Example: search text glued into `SELECT ... WHERE name = '...'`. Defense: parameterized/prepared statements or a safe ORM — never build SQL by string concatenation.