CODE EXAMPLE FOR SQL

SQL Injection Using Multiple Statement

$prod_id = $_GET["prod_id"];

$sql = "SELECT * FROM Products WHERE product_id = " . $prod_id;