What is sql injection in sql server?

SQL Injection is a hacking technique where a user types SQL into a normal input field prompting the program to execute the unintented SQL script against the database server. As an example, a field on a web site might prompt you to enter your SSN and it will look you up. Behind the Scenes, if the code is adding the SSN to a SQL Statement "SELECT * FROM tblEmployee WHERE SSN = '" & SSNFieldFromWebPage & "'" Entering in 123-45-6789 in that field would result in the following SQL... SELECT * FROM tblEmployee WHERE SSN = '123-45-6789' However, if the user enters something that the programmer didn't intend, such as... ' OR '1'='1 ...the resulting SQL could be... SELECT * FROM tblEmployee WHERE SSN = '' OR '1'='1' ...which would be true for ALL employees, resulting in ALL data being returned. SQL injection is just a threat that software developers need to consider when developing their applications to prevent users from doing unintended things. There are other things such as deleting all data in the database, changing passWords, setting up new user accounts, etc, that if everything is lined up just right could allow a hacker access to your systems or your private data. It's a form of Web Application Hacking Method.