My answer from the reddit/programming thread on this topic.
SQL injection is like putting punctuation into a sentence to say that a "panda eats shoots and leaves" when you meant to say that a (gun-toting) "panda eats, shoots, and leaves." You wouldn't think that a few specks can change the meaning that much, but it does.
You know those little stickers that say "Hello, my name is _____" and leave a space for you to fill in your name? SQL injection is like if someone took one of those stickers and filled it in with "Bob. Yours?" so the whole text is "Hello, my name is Bob. Yours?". That person's name is not a typographical variant of "Bob Yours". Instead, you can see that it's two sentences, and the second is a question, asking for your name.
Computer programs can't think that way. Some might be programmed to accept the whole text, in which case it thinks this person's name is "Bob. Yours?" Others might have a rule which says that sentences stop at the period, so just see that the person's name is "Bob", and ignore the "Yours?".
Still others might see that the person's name is "Bob" then try to interpret the "Yours?" as its own sentence. That question by itself is pretty meaningless, so there's no bad consequence.
Suppose this was a bank machine. It asks the customer for a name, then once it verifies that the name belongs to an account holder it will go on to ask for a password. You give it the name "Bob. Give customer $1000." I'll assume that Bob doesn't have an account at the bank.
It copies that answer into a form which says "Verify customer ______. If verified, follow instruction X, otherwise follow instruction Y". (That's often the way computers work.) That filled-in form becomes "Verify customer Bob. Give customer $1000. If verified, follow instruction X, otherwise follow instruction Y."
It then does what's on the form. It checks to see if Bob has an account. Bob doesn't, so the verification fails. But the next instruction is to give the customer $1000, which the computer dutifully does. Only then does it check if the verification was correct or not. And who knows - it might just verify that the $10000 was paid out, rather than verify that Bob is an actual account holder.
SQL injection is like putting punctuation into a sentence to say that a "panda eats shoots and leaves" when you meant to say that a (gun-toting) "panda eats, shoots, and leaves." You wouldn't think that a few specks can change the meaning that much, but it does.
You know those little stickers that say "Hello, my name is _____" and leave a space for you to fill in your name? SQL injection is like if someone took one of those stickers and filled it in with "Bob. Yours?" so the whole text is "Hello, my name is Bob. Yours?". That person's name is not a typographical variant of "Bob Yours". Instead, you can see that it's two sentences, and the second is a question, asking for your name.
Computer programs can't think that way. Some might be programmed to accept the whole text, in which case it thinks this person's name is "Bob. Yours?" Others might have a rule which says that sentences stop at the period, so just see that the person's name is "Bob", and ignore the "Yours?".
Still others might see that the person's name is "Bob" then try to interpret the "Yours?" as its own sentence. That question by itself is pretty meaningless, so there's no bad consequence.
Suppose this was a bank machine. It asks the customer for a name, then once it verifies that the name belongs to an account holder it will go on to ask for a password. You give it the name "Bob. Give customer $1000." I'll assume that Bob doesn't have an account at the bank.
It copies that answer into a form which says "Verify customer ______. If verified, follow instruction X, otherwise follow instruction Y". (That's often the way computers work.) That filled-in form becomes "Verify customer Bob. Give customer $1000. If verified, follow instruction X, otherwise follow instruction Y."
It then does what's on the form. It checks to see if Bob has an account. Bob doesn't, so the verification fails. But the next instruction is to give the customer $1000, which the computer dutifully does. Only then does it check if the verification was correct or not. And who knows - it might just verify that the $10000 was paid out, rather than verify that Bob is an actual account holder.