SQL injection
An attack where text typed into a field is run as a database command.
Definition
If an app builds database queries from raw user input, an attacker can type special text that changes the query. Manual testers don't need to exploit it, but entering characters like a single quote (') into fields and reporting server errors is a useful basic check.
In practice
Typing O'Brien into a name field crashes the sign-up with a database error. That's a sign the input isn't handled safely.
Learn it in context
Lessons that use this term.