SQL injection is a type of attack that can give an adversary complete control over your web application database by inserting arbitrary SQL code into a database query.

As one composes SQL Select statements, the author may use another query in place of any table or view. Even individual columns may be replaced with queries of varying complexity—if the result fits in ...