What is SQL injection and how do you prevent it?

SQL injection is an attack where malicious SQL code is inserted into an input field to manipulate the database.

**Example attack:**
```
Username: admin' OR '1'='1
Password: anything

Resulting query: SELECT * FROM users WHERE username='admin' OR '1'='1' AND password='anything'
-- '1'='1' is always true → bypasses login!
```

**Prevention:**
1. **Prepared statements / Parameterised queries** (most important)
```php
= ('SELECT * FROM users WHERE username = ?');
([]);
```
2. **Input validation** — whitelist allowed characters
3. **Least privilege** — DB user should only have SELECT/INSERT, not DROP
4. **WAF** (Web Application Firewall)
5. **ORM** — use frameworks that abstract SQL (Laravel Eloquent, Django ORM)

SQL injection is #3 in the OWASP Top 10.