2.2.1 SQL Injection
' OR 1=1 --` in a form field. The database executes the attacker's SQL.
Why it matters
This still dumps tables in 2026 when someone concatenates strings.
How it is used
Parameterized queries only. Never build SQL with string plus user input. Least-privilege DB users. WAF is a seatbelt, not the engine.