Dictionary · Hacking Techniques and Methodologies

A flaw in which untrusted input changes the meaning of a database query because the application treats that input as part of the query text. Parameterized queries are the standard fix.

The database should receive the user's text as data, never as instructions. Prepared statements, least-privilege database accounts, and careful error messages are the defensive pattern.

Example: A search box is rebuilt so the query structure stays fixed and the search text is passed as a parameter. The injection flaw is gone.