SQL Injection

SQL Injection is possible to alters the existing SQL commands to expose hidden data or to override the valuable ones, or even to execute dangerous system level commands on the database host. This is accomplished by the application taking user input ($_GET and $_POST) and combining it with static parameters to build an SQL query.