SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).

First-order SQL injection arises where the application takes user input from an HTTP request and, in the course of processing that request, incorporates the input into an SQL query in an unsafe way. In second-order SQL injection (also known as stored SQL

1 CREATE DATABASE IF NOT EXISTS zds_injections_sql CHARACTER SET utf8; 2 3 USE zds_injections_sql; 4 5 CREATE TABLE IF NOT EXISTS users (6 id INT UNSIGNED NOT NULL AUTO_INCREMENT, 7 username VARCHAR(20) NOT NULL, 8 password VARCHAR(40) NOT NULL, 9 rank TI