What is SQL injection and how do you prevent it?

Answer

SQL injection is when untrusted input changes the meaning of your SQL (e.g., by concatenating strings). Prevent it with parameterized queries/prepared statements, proper escaping by the driver/ORM, and least-privilege DB accounts.