SQL injection takes place when database software can’t tell the difference between arbitrary data from the user and genuine commands from the application. When an attacker injects commands into the data they send to a database, they can take database control away from the application owner.

Read full news article on Dzone