Web Vulnerabilities
SQL Injection
Also: SQLi, CWE-89
A flaw where user input is pasted into a database query and changes what the query means.
In more detail
Databases are driven by text commands written in SQL. If a program builds that text by joining strings, input can add its own SQL. The result can be reading rows that should be private, changing data, or in some systems more. It is fixed by parameterized queries, which send the command and the values separately.