The attack occurs when an adversary maliciously injects text, via an unprotected input field, that is going to change a SQL statement in way that it was not intended. code example

Example: sql injection attack

$value = "your value here";

try {
            $pdo = new PDO($dsn, $username, $password, $>drivers);
        } catch (\PDOException $e) {
            echo 'Connection Failed: ' . $e->getMessage();
        }
        
$sql = "INSERT INTO `my_db` SET `field` = ? ";
$stmt = $this->pdo->prepare($sql);
        $stmt->bindValue(1, $value, PDO::PARAM_STR);
        $stmt->execute();
        $stmt = null;