What is SQL injection?

SQL injection occurs when untrusted input changes the structure of a database command instead of remaining a value. Parameterized queries keep code and data separate and are the primary defense.