SQL injection

An attack that slips SQL into input pasted into a query, such as `' OR '1'='1` showing every customer. Placeholders stop it.