OWASP Top 10 put injection as the #1 risk. If an application has a SQL injection vulnerability, an attacker could read the data in the database. Including confidential information and hashed passwords (or worse, the application keeps the passwords in plain text).
SQL injection is a technique that is used to steal data by taking advantage of a non-validated input vulnerability. It is a code-injection technique where an attacker executes malicious SQL queries that control a web application’s database. With the right set of queries, a user can gain access to information stored in databases. For example, consider the following php code segment:
$variable = $_POST['input'];mysql_query("INSERT INTO `table` (`column`) ...
