SQL injection is a vulnerability where user input is placed directly into a database query, so an attacker can send input that changes what the query does. Instead of being treated as data, their input becomes part of the SQL, letting them read data they should not see, bypass logins, or delete records. The fix is to use parameterized queries.
How it happens
When a query is built by concatenating or interpolating user input, like "SELECT * FROM users WHERE email = '" + email + "'", an attacker can supply input like ' OR '1'='1 that changes the query's logic. The database has no way to tell the intended query from the injected part.
The fix: parameterized queries
Pass user values as bound parameters, so the database always treats them as data and never as SQL. Most ORMs and query builders do this for you. The rule is simple: never build a query by gluing request data into the query string.
What this means for AI-generated code
AI assistants often build queries with string interpolation because it reads cleanly and returns the right rows in testing, which is exactly why the injection risk survives review. If user input can reach a query that is built by concatenation, treat it as injectable.