How does SQL injection occur?

SQL injection occurs when a web application includes untrusted user input in an SQL query without proper validation or sanitization. Here’s how it typically happens:

User Input: The application accepts input from users, often through URL parameters, form fields, or cookies.
Insecure Query Construction: The application constructs SQL queries by directly incorporating this user input into the SQL statement. For example:
```
SELECT * FROM users WHERE id = 'user_input';
```
Malicious Input: An attacker can provide specially crafted input that alters the intended SQL query. For instance, if the attacker inputs:
```
1' OR '1'='1
```
The resulting SQL query becomes:
```
SELECT * FROM users WHERE id = '1' OR '1'='1';
```
This query will always return true, potentially exposing sensitive data.
Execution: The database executes the manipulated query, which can lead to unauthorized access, data retrieval, or even data modification.

To prevent SQL injection, developers should use prepared statements, parameterized queries, and proper input validation to ensure that user input is treated as data rather than executable code.