SQL-инъекция: что это, как работает и лучшие способы защиться

SELECT * FROM users WHERE username = 'Имя' AND password = 'Пароль';

' OR 1=1 --

SELECT * FROM users WHERE username = '' OR 1=1 -- 
AND password = '';

SELECT * FROM users WHERE username = 'логин' AND password = 'пароль';

SELECT * FROM users WHERE username = 'admin' --' AND password = '';

1 AND (SELECT COUNT(*) FROM users WHERE id=5)=1

SELECT name, price FROM products WHERE category_id = 1;

1 UNION SELECT username, password FROM users --

SELECT name, price FROM products WHERE category_id = 1
UNION
SELECT username, password FROM users;

John'; DROP TABLE users;--

{
  "username": "john",
  "password": "12345"
}

{
  "username": "john",
  "password": "' OR '1' = '1"
}

SELECT * FROM users WHERE username = 'user' AND password = '' OR 1=1 --';

You have an error in your SQL syntax near '1=1'

' OR 1=1 -- 

' AND SLEEP(5) --  

' UNION SELECT username, password FROM users --

-- Опасный запрос:
"SELECT * FROM users WHERE username = '" + userInput + "'"

-- Параметризованный запрос:
sql = "INSERT INTO Products (ProductName, Price) VALUES (?, ?)"

rows = conn.execute(sql, productName, price).rowcount

from django.db import models

class Student(models.Model):
    first_name = models.CharField(max_length=25)
    last_name = models.CharField(max_length=25)

student = Student.objects.get(id=1)
print(student.first_name)

SELECT first_name, last_name FROM student WHERE id = 1;

SQL syntax error near '1=1'