What opportunities does SQL injection provide for attackers or malicious users?

SQL injections allow attackers to inject and execute arbitrary SQL queries in the database through vulnerable points in the application. This can lead to:

• Unauthorized access to data (reading, modifying, deleting).
• Bypassing authentication and authorization mechanisms.
• Executing administrative commands on the database.
• Theft of confidential information, such as passwords or personal data.
• Data corruption or deletion.
• In some cases — executing commands on the server (if the database supports such capabilities).

Example: if the application constructs a query like:

SELECT * FROM users WHERE username = '" + userInput + "';

and the user inputs admin' OR '1'='1, then the query becomes:

SELECT * FROM users WHERE username = 'admin' OR '1'='1';

which returns all records, bypassing the check.