SQL Injection Vulnerability in Query

1. String concatenation to build SQL: "SELECT * FROM users WHERE name = '" + name + "'"
2. Not using prepared statements or parameterized queries
3. Insufficient input validation (blacklist instead of parameterization)
4. Escape characters not properly handled
5. Multi-step query building without parameterization

Always use parameterized queries/prepared statements. Example: PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE name = ?"); ps.setString(1, name). Use ORM (Hibernate, JPA) which parameterizes by default. Never concatenate user input into SQL strings. Validate input but don't rely on validation alone.