how to prevent sql injection

google

what is SQL Injection?

SQL injection is defined as a technique that takes advantage of non-validated input vulnerabilities and injects SQL commands through a web application that is executed in a back-end database. Programmers use sequential SQL command with client-supplied parameters making it easier for attackers to inject commands. Attackers can easily execute random SQL queries on the database server through a web application.

how does it work?

While performing SQL injection, attackers look for pages which allows the submission of data to the backend database, such pages are login page, search page, feedback page, registration page.
Attackers use a simple test to find vulnerabilities by simply passing single quotation marks in fields.

how to retrieve any data?

this can be used in the input box or even in the URL of the web page.
If there is a match, it will log in without a valid username and password.
Followings are few more inputs attackers may try.

' OR 1=1--

" OR 1=1--

' OR 'a'='a

" OR 'a'='a

') OR ('a'='a

SQL injection tools

SQLDict

SQLExec

sqlbf

SQLSMack

SQL2.exe

SQlPoke

NGSSQLCrack

SQLPing

sqlmap

sqlninja

SQLIer

Preventing SQL injection attacks

Never trust the input of users: check the text box entries by using the validation controls, regular expressions, code, etc

Never use dynamic SQL

Do not connect to a database using a root level account, use a limited access account.

Do not reveal much information in error messages.