The so-called SQL injection attack means that the attacker inserts SQL commands into the input field of the Web form or the query string of the page request, and deceives the server into executing malicious SQL commands. In some forms, user input is used directly to construct (or affect) dynamic SQL commands, or as input parameters for stored procedures. Such forms are particularly vulnerable to SQL injection attacks.