Hacking Websites with SQL Injection - Computerphile

The classic website attack, explained as a trick of language rather than wizardry. Tom Scott shows how a site that pastes whatever you type straight into its database query can be fooled into running your words as commands, letting an attacker read or wipe data through an ordinary login box. His example is a site written in PHP, and he talks through the query it builds, but you only need to follow which text came from the visitor. Nine minutes in, "sanitize your inputs" stops being a developer slogan and becomes common sense.