The login form
How the server builds it
The query the database receives
your input, still data
your input, now code
bound value, never parsed
The users table, and what comes back
| id | username | password | role |
|---|
—
A login form, and the query it builds underneath. Injection is not an incantation and the database is not tricked: it does exactly what the sentence says. The only question is who got to write the sentence.
| id | username | password | role |
|---|