SQL Injection

When a query is built by concatenating a string, a clever input can escape the intended data context and inject its own SQL logic — the oldest and still one of the most damaging web vulnerabilities.

Try this attack in the Playground

' OR 1=1-- turns a WHERE clause that should match one row into one that matches every row

Parameterized queries (prepared statements) separate code from data at the driver level

The database driver, not string formatting, is responsible for escaping values

Least-privilege database accounts limit the damage even if injection succeeds

Want this flow explained in detail as it plays?

POST/api/login

Headers

Host:app.flowground.dev

Content-Type:application/json

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

-- DO NOT DO THIS
const query = `SELECT * FROM users WHERE username = '${username}' AND password_hash = '${hash}'`;
db.raw(query);