How SQL injection works
Concatenation is the vulnerability. Tautologies, unions, and blind inference.
SQL injection happens in one place: user input concatenated into a query string. SELECT * FROM users WHERE name='$user' becomes a different query when $user contains a quote — the database cannot tell your data from the developer's code, because they arrived as one string.
Three shapes cover nearly everything. Tautology: ' OR '1'='1 makes the WHERE clause true for every row, so login checks pass as the first user — often the administrator. Union: UNION SELECT appends a second query whose output appears in the page, used to read other tables. Blind: when nothing is reflected, true/false questions leak data one bit at a time through timing or page differences.
The fix is structural, not filtering: parameterized queries (prepared statements) send code and data separately, so input can never become code. Escaping and blocklists lose; parameters win. Every database driver supports them, and using them is the entire remediation.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.