Q: An attacker discovers they can bypass your application's login form by entering `' OR 1=1 --` into the username field. What is this attack, and how do you prevent it natively in code?

This is a classic SQL Injection (SQLi) attack. The application is likely taking user input and directly concatenating it into a raw string to build the SQL query (e.g., SELECT * FROM users WHERE username = ' + input + '). The attacker's input alters the structural logic of the query so it always evaluates to true, logging them in as the first user in the table (usually the admin). The fundamental prevention technique is Parameterized Queries (Prepared Statements). Instead of raw concatenation, the developer uses parameter placeholders (e.g., WHERE username = ?). The database driver securely sends the query structure and the user input separately. The database treats the input strictly as literal data, completely neutralizing any malicious SQL meta-characters.