Can you give an example of an attack through malicious SQL code injection into an application?

A security vulnerability called SQL injection occurs when user input is directly inserted into an SQL query without proper sanitization. For example, in a Python application:

user_id = input("Enter user ID: ")
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

If an attacker enters 1; DROP TABLE users;, the query will execute a command to delete the table. To prevent this, parameterized queries should be used:

user_id = input("Enter user ID: ")
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

This ensures that the input is treated as data, not as part of the SQL code.