The term 'SQL Injection' means to inject malicious SQL statement(s) in an otherwise regular SQL to get access to secure data on a website. In this article, we will examine how SQL injection attacks are carried out and what programming techniques can be used to prevent them. While we will assume classic ASP pages and the backend SQL Server database to demonstrate the method and means of prevention, the concept is equally applicable to other web programming technologies and database systems.