SQL injection is an injection attack, which is caused by not isolating the code from the data in the project and mistakenly executing the data as a part of the code when reading the data.

How to deal with SQL injection? Three aspects:

1, filtering special characters in user input parameters to reduce risks;

2. It is forbidden to splice sql statements through strings and strictly use parameter binding to pass in parameters;

3. Reasonable use of the mechanism provided by the database framework.