Weakness

SQL injection

Slipping database commands into input an application passes to its database.

When an application builds database queries by pasting in user input, an attacker can change the query to read, change or delete data. Parameterised queries prevent it, yet it remains one of the most common web flaws.