Everything you wanted to know about SQL injection (but were afraid to ask)
troyhunt.com