SQL injection: keep data from becoming code
How the flaw arises, and why an error message is not enough to prove it.
Understand the cause
SQL injection becomes possible when user input changes the structure of a database query. A special character in a form is not an attack by itself; the issue lies in how the application constructs and executes the query.
Establish an observation
In a training lab, compare controlled input variations with the baseline request. A server error is a reason to investigate, not proof of SQL injection. You need a repeatable relationship between the input and a change in query behavior.
Keep the proof minimal
Use prepared lab records to confirm the issue. Extracting real tables is unnecessary to explain this vulnerability class. Record the parameter, preconditions and smallest observation that lets a developer reproduce the flaw.
Fix query construction
Parameterized queries separate values from SQL structure. Where parameters cannot be used, such as selecting a column name, use a restricted set of permitted choices. Also limit the database account’s privileges and repeat the test after remediation.